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EXECUTIVE  SUMMARY 


The  Problem 

When  the  D.C.  Snipers  conducted  their  rampage  of  shootings  in  the  National 
Capital  Region  (NCR)  in  October  of  2002,  local  law  enforcement  agencies  did  not  have  a 
framework  in  place  in  which  to  conduct  a  regional  investigation  for  the  murders  and 
shootings  that  spanned  seven  jurisdictions  in  D.C.  area.  One  of  the  ways  in  which  the 
Federal  Bureau  of  Investigation  (FBI)  and  the  Bureau  of  Alcohol,  Tobacco,  and  Fireanns 
(ATF)  assisted  local  law  enforcement  in  the  investigation  was  by  establishing  a  Joint 
Operations  Center  that  functioned  as  the  hub  and  the  template  for  conducting  an 
investigation  involving  dozens  of  law  enforcement  agencies.  This  paper  discusses  how 
the  NCR  local  law  enforcement  agencies  can  prepare  to  conduct  regional  investigations 
by  developing  a  framework  for  that  mission,  and  makes  recommendations  to  the  NCR 
Police  Chiefs  Committee  for  how  that  process  should  proceed.  This  is  a  capabilities- 
based  approach  to  preparing  NCR  local  law  enforcement  agencies  to  manage 
multijurisdictional  investigations  of  any  scale. 

The  National  Capital  Region  (NCR) 

The  NCR  consists  of  18  jurisdictions  in  and  around  Washington,  D.C.,  There  are 
eight  primary  jurisdictions  and  another  10  municipalities  within  their  parent  counties  in 
Northern  Virginia  and  Maryland.  Law  enforcement  is  fragmented  in  the  NCR  because  of 
jurisdictional  boundaries  with  each  of  the  major  jurisdictions  and  most  of  the 
municipalities  having  full-service  police  departments.  Additionally,  the  FBI  and  ATF 
divide  responsibility  for  the  NCR  between  two  regional  offices  with  the  Baltimore  Field 
Offices  having  jurisdiction  over  the  Maryland  counties  and  the  Washington  Field  Offices 
having  jurisdiction  over  Washington,  D.C.,  and  Northern  Virginia.  The  state  police 
agencies  of  Maryland  and  Virginia  do  not  have  primary  investigative  responsibilities  for 
serious  crimes  occurring  in  the  NCR  outside  of  the  interstate  highways.  Despite  this 
jurisdictional  fragmentation  in  law  enforcement,  the  NCR  does  maintain  a  Police  Chiefs 
Committee  that  has  representation  from  federal,  state,  and  local  law  enforcement 
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agencies.  This  committee  provides  a  mechanism  and  focal  point  for  collaboration 
between  the  various  agencies  and  levels  of  government. 

Research  to  Help  Develop  a  Framework 

To  develop  the  framework  for  regional  investigations,  this  paper  examines 
information  gleaned  from: 

•  Federal  and  regional  documents  and  plans  that  promote  collaboration  in  a 
capabilities-based  preparedness  environment; 

•  Lessons-learned  from  the  D.C.  Sniper  case  outlined  in  the  after  action 
report  titled  Managing  a  Multijurisdictional  Case  which  was  published  by 
the  Police  Executive  Research  Forum  (PERF); 

•  The  National  Incident  Management  System  (NIMS); 

•  Academic  research  on  collaboration;  and 

•  A  Delphi-survey  conducted  with  19  senior  subject  matter  experts  from 
several  disciplines  in  the  NCR. 

Some  of  the  documents  that  provide  bedrock  of  support  for  this  paper  focus  on  a 
regional  approach  to  capabilities-based  planning  to  fulfill  the  five  homeland  security 
missions  of  prevention,  protection,  response,  mitigation,  and  recovery.  They  include: 

•  The  Homeland  Security  Presidential  Directive  -  5  that  mandates  the  use  of 
the  National  Incident  Management  System  across  all  jurisdictions,  levels 
of  government,  and  private  agencies  for  managing  incident  response. 

•  Presidential  Policy  Directive  8  and  the  National  Preparedness  Goal  that 
mandates  a  whole-community  based  approach  to  planning;  and 

•  The  NCR  Homeland  Security  Strategic  Plan  2010. 

PERF  was  contracted  by  the  United  States  Department  of  Justice  to  conduct  an 
after  action  analysis  of  the  D.C.  Sniper  investigation  of  2002.  PERF  perfonned  an 
extensive  analysis  of  the  investigation  by  interviewing  many  of  those  involved  in  the 
investigation,  examining  documents,  and  visiting  facilities  and  locations  of  the  crimes.  It 
published  its  findings  in  the  2004  report  Managing  a  Multijurisdictional  Case.  Key 
recommendations  in  the  report  focus  on  leadership,  collaboration,  the  Joint  Operations 
Center,  managing  information,  employing  an  incident  management  system,  and 
maintaining  good  communication. 
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To  determine  how  the  National  Incident  Management  System  could  be  used  in  the 
investigative  framework,  the  writer  compared  and  contrasted  NIMS  with  the  incident 
management  model  of  the  United  Kingdom  -  the  Gold-Silver-Bronze  model.  Both 
systems  provide  a  perspective  that  can  very  useful  to  managing  a  regional  investigation, 
especially  these  three  elements  of  the  Command  and  Management  Component  of  NIMS: 
The  Incident  Command  System  (ICS),  the  Multiagency  Coordination  Group  (MAC 
Group),  and  Public  Information  (Media). 

Since  managing  a  regional  investigation  will  require  a  great  deal  of  collaboration 
on  the  part  of  many  people  and  agencies,  the  writer  examined  academic  research  on 
collaboration  to  detennine  what  factors  tended  to  foster  or  inhibit  collaboration.  These 
factors  can  be  divided  into  three  basic  categories:  1)  leadership;  2)  structural 
foundations;  and  3)  technology.  A  successful  collaborative  endeavor  must  have 
leadership  that  does  the  things  that  foster  collaboration  and  avoids  doing  those  things  that 
hinder  collaboration.  But  leaders  also  need  to  function  in  an  environment  that  promotes 
collaboration  through  policies,  facilities,  organizations,  training,  education,  exercises,  and 
other  structural  underpinnings.  And  finally,  there  must  be  the  technology  to  facilitate 
effective  communication  and  data  management. 

To  solicit  support  for  developing  an  NCR  framework  for  managing  regional 
investigations,  the  writer  conducted  a  Delphi  survey  of  19  senior  subject  matter  experts 
(SMEs)  from  the  NCR.  Thirteen  SMEs  were  from  law  enforcement  and  represented  the 
two  FBI  offices  servicing  the  NCR,  the  eight  primary  NCR  jurisdictions,  two 
municipalities,  and  incident  command  from  the  D.C.  Sniper  task  force.  The  other  six 
SMEs  represented  the  disciplines  of  fire/EMS,  public  information  officers,  and  the  three 
fusion  centers  servicing  the  NCR.  These  SMEs  furnished  their  professional  opinions  on 
how  various  law  enforcement  agencies  and  the  other  disciplines  could  work  together  to 
sustain  a  regional  law  enforcement  investigation.  There  was  considerable  agreement 
between  the  academic  research  on  collaboration  and  the  SMEs’  insights  on  collaboration, 
as  well  as  the  value  of  using  a  standard  incident  management  system  such  as  NIMS  to 
manage  an  investigation.  Additionally,  all  of  the  SMEs  embraced  the  concept  of  creating 
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a  framework  for  conducting  regional  investigations  and  also  using  non-law  enforcement 
disciplines  to  help  support  an  investigation. 

Recommendations 

Based  upon  the  support  from  federal  and  NCR  preparedness  planning  documents, 
academic  research,  lessons  learned  from  the  D.C.  Sniper  investigation,  and  the  NCR 
subject  matter  experts,  this  paper  concludes  with  10  recommendations  to  the  NCR  Police 
Chiefs  Committee.  The  recommendations  focus  on  creating  an  investigative 
subcommittee  of  the  Police  Chiefs  Committee  that  will  oversee  the  development  of  the 
investigative  framework.  The  subcommittee  should  strongly  consider  input  provided  by 
the  PERF  report,  the  NCR  SMEs,  and  the  National  Incident  Management  System. 
Furthermore,  the  subcommittee  should  identify  technology  requirements  to  support 
secure  communication  and  data  management,  and  make  recommendations  to  the  Police 
Chiefs  Committee  for  grant  investments.  And  finally,  the  subcommittee  should  create  an 
education,  training,  and  exercise  plan  to  develop  and  validate  the  capabilities  necessary 
for  conducting  an  effective  and  efficient  multijurisdictional  investigation. 
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I.  INTRODUCTION 


What  if  there  was  another  round  of  murderous  attacks  in  the  National  Capital 
Region  (NCR)  similar  to  the  DC  Sniper  attacks  in  2002;  or  if  a  serial  rapist  were 
terrorizing  citizens,  making  them  fearful  of  being  either  out  in  public  or  home  alone;  or  if 
elderly  residents  in  wealthy  neighborhoods  were  living  in  anxiety  because  they  were 
targeted  for  home  invasion  robberies  by  criminals  who  stalk  the  weak  and  defenseless? 
What  if  a  Mumbai-style  terrorist  attack  were  to  occur?  Is  the  NCR  law  enforcement  (LE) 
community  prepared  to  coordinate  an  efficient  and  effective  investigative  response  to 
shut  down  these  serial  criminals  and  bring  them  to  justice?  This  paper  will  examine  how 
the  NCR  can  prepare  to  mount  an  intergovernmental,  interagency,  and  multidisciplinary 
investigation  of  a  series  of  crimes  spanning  multiple  jurisdictions. 

A.  PROBLEM  STATEMENT 

When  the  DC  Snipers  commenced  their  shooting  rampage  in  and  around  the 
National  Capital  Region  (NCR)  in  October  of  2002,  the  NCR  local  LE  agencies  were  not 
prepared  to  conduct  the  type  of  intergovernmental  and  interagency  investigation 
necessary  for  such  a  dynamic  series  of  crimes  spanning  multiple  jurisdictions.  In  a  span 
of  19  days,  10  people  were  murdered  and  three  others  were  wounded  in  five  NCR 
jurisdictions  and  two  other  Virginia  jurisdictions  (Murphy  &  Wexler,  2004,  pp.  7-12). 

Since  Montgomery  County,  Maryland  experienced  the  first  five  of  the  sniper 
murders  in  less  than  a  16-hour  period,  the  Montgomery  County  Police  (MCP)  assumed 
the  role  of  lead  investigative  agency  (Murphy  &  Wexler,  2004,  p.  20).  As  the  shootings 
continued  in  other  jurisdictions  in  and  around  the  NCR,  more  than  a  thousand  federal, 
state,  and  local  law  enforcement  investigators  joined  in  what  may  have  been  the  largest 
multijurisdictional  investigation  in  U.S.  history  (Murphy  &  Wexler,  p.  v).  This  influx  of 
resources  overwhelmed  the  ability  of  the  MCP  to  manage  such  a  large-scale  investigation 
(Murphy  &  Wexler,  pp.  42-43).  The  Bureau  of  Alcohol,  Tobacco,  and  Firearms  (ATF) 
and  the  Federal  Bureau  of  Investigation  (FBI)  had  experience  recently  during  the 
investigations  of  the  9/11  terrorist  attacks  (2001)  and  the  Oklahoma  City  terrorist 
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bombing  (1995)  of  working  within  a  federal  Joint  Operations  Center  (JOC),  which 
provided  a  facility  and  a  structure  for  managing  large-scale  investigations  (Murphy  & 
Wexler,  p.  42). 

As  a  region  of  both  national  and  international  importance,  the  NCR  is  a  target-rich 
environment  for  not  only  terrorist  attacks  but  other  high-profile  non-terrorist  pattern 
crimes  such  as  murders,  sexual  assaults,  and  violent  anned  robberies.  Currently,  there  are 
no  regional  models  or  guidelines  for  how  the  NCR  will  launch  an  integrated 
intergovernmental,  interagency,  and  multidisciplinary  investigative  response  to  a  series  of 
crimes  spanning  multiple  jurisdictions.  While  many  NCR  local  LE  agencies  work 
together  in  task  forces  for  street  level  crimes  (e.g.,  gangs,  drugs,  firearms),  they  rarely 
work  together  on  investigations  that  would  require  dozens,  or  even  hundreds,  of 
investigators  as  occurred  during  the  DC  Sniper  case.  There  were  many  lessons-leamed 
during  that  investigation;  however,  the  NCR  has  not  developed  an  investigative  model 
that  incorporates  those  lessons-learned. 

The  consequences  of  not  having  an  investigative  model  in  place  could  be 
detrimental  to  a  multijurisdictional  investigation  and  to  any  subsequent  prosecution. 
There  would  likely  be  problems  relating  to  investigative  command,  coordination, 
communication,  and  data-sharing  between  the  different  jurisdictions.  This  could  lead  to  a 
host  of  investigative  troubles,  including  inconsistent  or  duplicative  effort,  incomplete 
situational  awareness,  and  confusing  or  erroneous  public  messaging. 

This  issue  merits  further  research  to  ensure  that  the  full  range  of  NCR  resources 
from  LE  and  other  disciplines  could  be  marshaled  effectively  and  efficiently  to  mount  a 
successful  investigative  response  to  a  series  of  pattern  crimes  spanning  multiple  NCR 
jurisdictions.  Creating  an  intergovernmental,  interagency,  and  multidisciplinary 
investigative  framework  would  enhance  command,  coordination,  communication,  and 
data-sharing  between  agencies.  It  would  also  facilitate  a  timely,  efficient,  and  successful 
multijurisdictional  investigative  response. 
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B.  RESEARCH  QUESTION 


How  can  the  National  Capital  Region  (NCR)  prepare  for  an  integrated 
intergovernmental,  interagency,  and  multidisciplinary  investigative  response  to  a  critical 
series  of  crimes  spanning  multiple  NCR  jurisdictions? 

1.  Sub-Questions 

1.  How  would  the  investigative  response  differ  between  crimes  having  a 
terrorism  nexus  and  those  that  do  not? 

2.  How  can  “lessons-learned”  from  the  DC  Sniper  investigation  of  2002  be 
integrated  into  the  investigative  plan? 

3.  How  can  the  National  Incident  Management  System  (NIMS)  be  utilized  to 
facilitate  management  of  the  investigation? 

4.  How  can  lirc/EMS,  fusion  centers,  and  the  public  information  disciplines 
be  incorporated  into  the  investigative  plan? 

5.  What  are  the  challenges  of  integrating  managerial,  investigative,  and 
multidisciplinary  protocols  involving  18  NCR  local  jurisdictions  and  the 
FBI? 

2.  Context  for  Answering  These  Questions 

To  lay  a  foundation  for  answering  these  questions,  this  chapter: 

•  offers  background  information  about  the  NCR  to  provide  a  context  in 
which  to  understand  the  multijurisdictional  landscape; 

•  proposes  central  arguments  that  claim  that  the  NCR  law  enforcement 
community  (LE)  can,  and  should,  develop  a  local  LE  investigative 
framework  for  regional  investigations; 

•  examines  the  after  action  analysis  of  the  DC  Sniper  investigation  that 
provides  valuable  lessons-learned  to  incorporate  into  the  plan; 

•  suggests  that  the  incident  management  models  from  the  United  States  and 
the  United  Kingdom  provide  insight  into  formulating  a  management 
structure  for  an  investigation; 

•  contends  that  LE  should  leverage  the  resources  of  other  disciplines  to 
assist  in  an  investigation;  and  that  LE  will  need  to  develop  protocols  for 
how  diverse  agencies  and  disciplines  will  work  together. 

This  chapter  also  presents  a  literature  review  that  discusses  some  of  the  research 
that  will  lay  a  solid  groundwork  for  developing  a  successful  plan.  Additionally,  to 
engender  buy-in  and  support  for  a  regional  plan,  the  writer  solicited  opinions  from  key 
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NCR  leaders  /  subject  matter  experts  who  would  be  operating  within  the  parameters  of 
this  plan.  The  method  used  to  glean  these  insights  was  the  Delphi  research  method,  which 
will  be  discussed  later  in  this  chapter. 

This  research  could  lead  to  profitable  outcomes  not  only  for  the  NCR,  but  also  for 
other  areas  in  the  United  States  seeking  a  model  that  incorporates  LE  operations  and 
other  available  resources  to  ensure  a  successful  conclusion  to  an  investigation.  The 
process  of  collaborative  planning  to  integrate  a  wide  array  of  response  resources  dovetails 
well  with  national  preparedness  goals  outlined  in  documents  such  as  the  National 
Response  Framework  (U.S.  Department  of  Homeland  Security  [DHS],  2008b), 
Presidential  Policy  Directive  8  (White  House,  2011),  the  National  Preparedness  Goal 
(DHS,  2011),  and  Homeland  Security  Presidential  Directives  5  (White  House,  2003), 
among  others. 

C.  A  NATIONAL  CAPITAL  REGION  PRIMER 

The  NCR  is  a  federally  recognized  region  comprised  of  18  jurisdictions  that 
include  Washington,  D.C.,  and  the  surrounding  counties  and  incorporated  cities  from 
Maryland  and  Virginia  (United  State  Code,  Title  40).  There  are  eight  major  jurisdictions, 
while  the  remaining  ten  jurisdictions  are  incorporated  cities  within  parent  counties 
(MWCOG  HLS  Strategic  Plan,  2010)  (see  Figure  1).  The  Washington,  D.C.,  and  the 
Maryland  counties  are  geographically  separated  from  the  northern  Virginia  jurisdictions 
by  the  Potomac  River.  With  2,500  square  miles  and  a  population  of  over  five  million,  the 
NCR  is  the  fourth  largest  metropolitan  area  in  the  country  (Federal  Emergency 
Management  Agency  [FEMA],  2011). 


4 


Figure  1.  The  National  Capital  Region  (From  FEMA,  2012) 


There  is  no  central  government  in  the  region,  but  rather  each  jurisdiction 
maintains  its  own  independence;  however,  in  many  respects,  the  region  is  fairly  well- 
organized  because  of  the  role  played  by  the  Washington  Metropolitan  Council  of 
Governments  (COG  or  MWCOG)  which  facilitates  the  coordination  of  many 
governmental  functions  in  the  region  (MWCOG,  2010,  p.  B2-10).  COG  supports  15 
regional  emergency  support  functions  (R-ESFs)  that  pursue  preparedness  activities  for 
public  safety  planning  and  response  actions,  including  the  Police  Chiefs  Committee,  the 
Fire  Chiefs  Committee,  and  the  External  Affairs  Committee  (MWCOG,  2010,  p.  B5-7). 
The  NCR  has  generated  many  regional  planning  documents  including  the  Regional 
Emergency  Coordination  Plan  (MWCOG,  2002)  and  a  Homeland  Security  Strategic 
Plan ,  (MWCOG,  2010). 

LE  is  fragmented  in  the  region  as  each  of  the  18  NCR  jurisdictions  and  other  non¬ 
incorporated  towns  maintains  its  own  LE  agency,  while  two  FBI  field  offices  divide 
responsibilities  in  the  region  (Federal  Bureau  of  Investigation  [FBI,  n.d.]). 
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D.  ARGUMENTS 


1.  Local  LE  Multijurisdictional  Investigative  Model 

Rather  than  depending  on  federal  law  enforcement  agencies  to  provide  the 
structure  and  resources  to  manage  a  series  of  pattern  crimes  spanning  multiple  NCR 
jurisdictions,  the  NCR  local  LE  agencies  should  develop  a  plan  and  the  capabilities 
necessary  for  managing  such  investigations. 

One  of  the  crucial  issues  is  to  identify  the  differences  in  an  investigation  that  has  a 
terrorism  nexus  and  one  that  does  not.  The  National  Response  Framework  (NRF)  (DHS, 
2008b)  has  identified  the  Department  of  Justice  (DOJ)  as  the  lead  investigative  entity  for 
terrorism  incidents,  and  the  DOJ  has  assigned  that  responsibility  to  the  FBI  (U.S.  DHS, 
2008)  p.  TER-2).  Because  the  FBI  has  its  own  protocols  for  managing  terrorism 
investigations,  if  local  LE  were  to  support  an  FBI  terrorism  investigations,  local  LE 
would  have  to  follow  the  FBI  investigative  model.  If  a  multijurisdictional  series  of  crimes 
did  not  have  a  nexus  to  terrorism,  then  the  local  LE  agencies  would  most  likely  be  the 
lead  investigative  agencies  and  would  need  a  model  or  guidelines  to  help  them  integrate 
the  investigation.  Although  local  LE  may  be  the  investigative  lead,  federal  LE  in  the 
NCR  has  a  history  of  providing  generous  support  to  augment  local  investigative 
capabilities  without  assuming  the  management  of  the  investigation.  For  the  investigation 
of  pattern  crimes  spanning  multiple  NCR  jurisdictions,  it  is  imperative  to  determine 
whether  a  federal  LE  agency  is  the  lead  agency  or  a  support  agency;  a  detennination  that 
is  sometimes  hard  to  make  because  the  line  between  terrorism  and  other  crimes  is 
sometimes  blurred.  The  expectations  that  federal  and  local  LE  agencies  will  have  of  each 
other  will  be  different  depending  on  who  is  the  lead  investigative  agency. 

2.  Learning  from  History 

The  DOJ  contracted  with  the  Police  Executive  Research  Forum  (PERF)  to 
conduct  an  after-action  analysis  of  the  DC  Sniper  investigation.  The  report  Managing  a 
Multijurisdictional  Case  (Murphy  &  Wexler,  2004)  proffered  dozens  of  conclusions  and 
lessons-leamed  from  the  investigation.  The  report  addressed  the  issues  of  leadership, 
federal  LE  resources,  managing  investigations,  information  management,  local  LE 
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operations,  the  media,  and  the  community.  Although  the  report  made  recommendations 
for  how  the  NCR  could  conduct  a  similar  investigation  in  the  future  (Murphy  &  Wexler, 
2004),  NCR  local  LE  agencies  have  not  adopted  the  recommendations.  One  of  the 
possible  reasons  for  this  could  be  that  there  has  not  been  a  champion  to  shepherd  these 
recommendations  through  the  process  of  becoming  a  regional  investigative  model.  This 
research  project  is  intended  as  a  step  towards  making  that  happen;  however,  it  will 
require  the  time,  effort,  input,  and  buy-in  of  key  LE  managers,  supervisors,  and 
investigators  from  many  agencies. 

3.  Incident  Management 

Homeland  Security  Presidential  Directive-5  (HSPD-5)  mandates  that  the  National 
Incident  Management  System  (NIMS)  be  used  as  the  comprehensive  approach  to  incident 
management  (White  House,  2003,  p.  1).  The  objective  is  “to  ensure  that  all  levels  of 
government  across  the  Nation  have  the  capability  to  work  efficiently  and  effectively 
together,  using  a  national  approach  to  domestic  incident  management”  (White  House, 
2003,  p.  1).  One  of  the  goals  of  NIMS  is  to  provide  a  vehicle  for  different  agencies  to 
seamlessly  integrate  their  response  operations  (White  House,  2003,  pp.  1-2).  While  LE 
officers  may  have  been  trained  to  the  requisite  levels  of  NIMS,  there  is  oftentimes  a 
disconnection  between  the  training  and  the  use  of  NIMS.  The  consequences  of  this 
disconnection  is  that  when  LE  needs  NIMS  to  manage  a  large-scale  incident  or 
investigation,  LE  personnel  may  not  have  the  necessary  comfort  level  with  NIMS  to  use 
it  effectively.  Because  LE  leaders  know  beforehand  that  certain  things  will  have  to  be 
done  in  a  multijurisdictional  investigation,  an  investigative  NIMS-compliant  framework 
could  be  developed  beforehand,  just  as  an  agency  would  do  for  any  preplanned  event. 
The  structure  should  promote  the  NIMS  concepts  of  the  Incident  Command  System 
(ICS),  Multiagency  Coordination  System,  and  the  Joint  Infonnation  System.  Preplanning 
will  help  formulate  an  investigative  model  or  guidelines  in  a  time  of  calm  rather  than  in 
the  middle  of  a  dynamic  or  deadly  series  of  crimes. 

The  DC  Sniper  investigation  concluded  prior  to  the  issuance  of  HSPD-5  and  did 
not  directly  follow  the  precepts  of  NIMS;  however,  when  superimposing  the  joint 
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operations  center  (JOC)  model  over  the  NIMS  model,  one  can  see  many  commonalities 
between  the  two  management  systems.  The  NIMS  model  provides  a  significant  level  of 
functionality  for  managing  an  incident  or  investigation;  however,  many  people  find  the 
system  too  complicated  to  understand  or  retain  without  regular  use.  The  United 
Kingdom’s  (UK)  Gold-Silver-Bronze  incident  management  model  is  a  simpler  model  to 
understand  but  lacks  the  robust  functionality  of  the  NIMS  model.  Incorporating  some  of 
the  simple  verbiage  of  the  UK’s  model  into  the  NIMS  incident  management  model  would 
help  provide  a  more  meaningful  concept  of  operations  to  those  who  do  not  require  a  full 
understanding  of  NIMS/ICS  to  perfonn  their  response  duties  within  the  system. 

4.  Joint  versus  Networked  Investigations 

The  traditional  LE  model  of  conducting  a  joint  investigation  or  task  force  is  to 
manage  the  investigation  out  of  a  single  command  post  or  joint  operations  center  (JOC). 
JOCs  are  typically  ad  hoc  locations  established  to  manage  intergovernmental  and/or 
interagency  investigations.  They  bring  all  the  relevant  stakeholders  together  to  work  side- 
by-side,  but  they  can  be  expensive  to  stand-up  and  maintain.  In  addition,  they  can  reduce 
the  efficiency  of  personnel  who  have  to  travel  long  distances  to  work  in  them.  For  some 
investigations,  a  JOC  may  continue  to  be  the  best  option  to  manage  the  cases.  For  other 
regional  investigations,  a  network  of  command  posts  may  be  a  better  option.  The  network 
of  command  posts  means  that  managers,  supervisors,  and  investigators  from  different 
agencies  would  manage  and  investigate  the  cases  from  their  usual  work  locations; 
however,  they  would  communicate,  coordinate,  and  share  data  with  each  other  using 
technology.  This  technology  would  include  data-sharing  mechanisms  in  which 
investigators  would  share  a  common  case  file  and  audio/video  communications,  such  as 
conference  calls  or  video  teleconferencing  (VTC).  There  are  advantages  and 
disadvantages  with  both  the  JOC  and  network  of  command  posts  models,  but  each  may 
have  a  role  depending  on  the  nature  of  the  regional  investigation. 

The  NCR  is  an  organized  and  resource-rich  region  as  will  be  demonstrated  in  the 
next  chapter.  For  a  multijurisdictional  investigation,  FE  should  recruit  other  disciplines  to 
help  accomplish  its  goals.  The  NCR  is  served  by  three  fusion  centers  (D.C.,  Maryland, 
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and  northern  Virginia),  many  fire  departments,  and  public  information  officers  in  all 
jurisdictions.  A  challenge  for  LE  is  to  recognize  the  utility  of  the  capabilities  of  other 
disciplines  and  then  incorporate  those  disciplines  into  the  regional  investigative  plan. 

5.  Regional  Investigative  Protocols 

Each  LE  agency  has  protocols  for  how  to  conduct  investigations.  If  the  FBI  were 
the  lead  investigative  agency,  would  there  be  just  one  set  of  investigative  protocols  for  all 
involved  agencies?  If  NCR  local  LE  were  the  lead  agencies,  should  there  be  one  set  of 
common  protocols?  The  answer  to  these  questions  mirrors  the  answer  to  a  previous 
question  that  recognizes  the  need  to  detennine  whether  the  lead  agency  is  federal  or  local 
LE.  Since  the  FBI  is  a  national  organization  whose  cases  are  prosecuted  in  the  U.S. 
federal  courts  by  federal  prosecutors,  its  investigative  protocols  are  mostly  standard  from 
one  field  office  to  another.  The  FBI  would  require  local  LE  to  follow  the  FBI’s  protocols 
when  assisting  an  FBI  investigation. 

If  NCR  local  LE  agencies  are  the  lead  agencies,  it  is  unlikely  that  there  would  be 
common  investigative  protocols  since  there  are  too  many  local  agencies  that  would  have 
to  synchronize  their  procedures.  State,  county,  and  municipal  laws  may  differ  from 
jurisdiction  to  jurisdiction,  which  might  prevent  the  coordination  of  policies  and 
procedures.  If  local  LE  agencies  are  successfully  prosecuting  cases  using  their  own 
protocols,  is  there  a  need  to  change  them  to  fit  a  common  NCR  protocol? 

It  seems  unnecessary  and  impracticable  to  modify  an  agency’s  investigative 
protocols  to  fit  a  regional  model;  however,  there  should  be  common  protocols  for  how 
agencies  will  work  together  during  a  joint  investigation  (e.g.,  command  structure, 
problem  resolution,  data-sharing,  communication,  and  coordination  activities).  These 
tasks  are  not  accomplished  in  isolation  but  rather  jointly  by  multiple  agencies;  therefore, 
regional  protocols  defining  working  relationships  are  necessary  for  effectiveness  and 
efficiency. 
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E.  LITERATURE  REVIEW 

1.  National  Capital  Region 

There  are  quite  a  number  of  references  in  the  literature  concerning  the  National 
Capital  Region.  These  references  describe  the  jurisdictional  components  of  the  region  and 
report  on  the  region’s  population,  economic,  and  governmental  data.  Within  the  NCR, 
there  is  another  regional  entity  called  the  Metropolitan  Washington  Council  of 
Governments  (MWCOG,  aka  COG),  which  is  a  regional  non-governmental  independent 
non-profit  organization  fonned  in  1957  to  facilitate  regional  planning  in  the  D.C.  area. 
Since  then,  COG  has  evolved  into  a  much  larger  structure  that  forms  the  latticework  for 
how  the  NCR  conducts  preparedness  activities  within  the  scope  of  the  National  Response 
Framework  (DHS,  2008b).  The  NCR  and  COG  jurisdictions  overlap,  except  that  COG 
has  two  additional  Maryland  counties  and  two  additional  municipalities.  There  is  ample 
data  online  and  in  the  literature  describing  both  the  NCR  and  COG. 

2.  NCR  Documents 

The  NCR  released  its  latest  Homeland  Security  Strategic  Plan  in  2010  (MWCOG, 
2010),  which  outlines  its  plan  for  achieving  priority  capabilities  over  the  next  three  to 
five  years.  Priorities  include  regional  collaboration  for  planning  and  decision  making  for 
activities  relating  to  all-hazards  preparedness  for  the  four  homeland  security  missions  in 
effect  at  the  time  of  publishing:  to  prevent,  protect  against,  respond  to,  and  recover  from 
all  hazard  incidents  (MWGOG,  2010).  Fundamental  goals  include  (MWCOG,  2010a): 

•  enhancing  regional  capabilities  for  fashioning  interoperable 

communications  for  voice,  data,  and  video  (p.7); 

•  identifying  essential  elements  of  data  within  each  discipline  that  should  be 
shared,  and  then  developing  business  practices  and  communications 
technical  standards  to  maintain  situational  awareness  (p.8);  and 

•  ensuring  that  NCR  fusions  centers  share  data  in  both  secure  and  non- 
secure  systems  (p.9). 

In  addition,  the  plan  recognizes  that  the  Regional  Emergency  Support  Functions 
(R-ESFs)  are  responsible  for  identifying  preparedness  gaps  and  notifying  appropriate 
NCR  leadership  committees  of  the  need  for  grant  funds  and  other  resources  to  close  those 
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gaps  (MWGOG,  2010b,  p.  B5).  This  document  provides  the  underlying  support  for  this 
paper  that  seeks  to  craft  guidelines  for  command,  communication,  coordination,  and 
information-sharing  in  a  regional  LE  investigation. 

Another  plan  used  is  the  NCR  Regional  Emergency  Coordination  Plan  (RECP)  is 
a  plan  to  enhance  regional  communications  and  coordination  during  a  disaster  or 
emergency  (MWCOG  Task  Force  on  Homeland  Security  and  Emergency  Preparedness 
for  the  National  Capital  Region,  2002,  p.  1).  The  Regional  Incident  Communications  and 
Coordination  System  (RICCS)  as  one  of  the  linchpins  of  the  plan,  and  is  a  system  of  text 
messages,  conference  calls,  and  Web-communication  that  facilitates  situational 
awareness  and  coordination  within  and  between  R-ESFs  after  major  incidents  or 
emergencies  (MWCOG  Task  Force  on  Homeland  Security  and  Emergency  Preparedness 
for  the  National  Capital  Region,  2002,  p.  2).  RICCS  may  be  a  good  way  to  initiate  a 
coordinated  investigation;  however,  RICCS  is  not  designed  for  the  long-term 
communication  needs  of  an  extended  regional  investigation.  No  such  long-term  regional 
communication,  coordination,  and  information-sharing  system  exits  in  the  NCR  for 
managing  a  complex  investigation.  This  paper  will  address  this  issue. 

3.  Fusion  Centers 

Three  fusion  centers  serve  the  NCR: 

1 .  Maryland  Coordination  and  Analysis  Center  (MCAC); 

2.  the  Washington  Regional  Threat  Analysis  Center  (WRTAC);  and 

3.  the  Northern  Virginia  Regional  Intelligence  Center  (RIC). 

There  is  some  information  about  MCAC  on  its  website;  however,  the  various 
intelligence  products  produced  by  these  centers  form  the  body  of  literature  about  those 
centers. 

The  National  Incident  Management  System  recognizes  the  importance  of  the 
intelligence/investigation  function  and  places  it  within  the  ICS  model  in  a  variety  of 
ways.  However,  there  is  virtually  no  literature  on  how  fusion  centers  can  assist  in  a 
multijurisdictional  investigation  beyond  their  usual  attempt  at  “connecting  the  dots”  from 
multiple  sources  of  information.  Fusion  centers  have  resources  that  can  assist 
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investigators  in  conducting  routine  investigative  functions  normally  perfonned  by 
detectives  (e.g.,  perfonning  background  checks  on  a  multitude  of  suspects,  gathering  and 
analyzing  infonnation  from  a  variety  of  R-ESF  functions  involved  in  the  investigation, 
and  disseminating  for  official  use  only-law  enforcement  sensitive  (FOUO-LES) 
infonnation  to  a  wide  EE  audience).  This  paper  may  help  to  break  new  ground  in  the 
utility  of  fusion  centers  in  support  of  regional  investigations. 


4.  Successful  Collaboration 


There  have  been  numerous  theses  written  by  students  in  the  Center  for  Homeland 
Defense  and  Security  (CHDS)  master’s  program  addressing  the  issue  of  interagency  and 
inter-discipline  collaboration,  drawing  upon  the  body  of  literature  in  business,  academia, 
and  government.  Some  original  research  has  also  been  conducted  by  staff  researchers  at 
the  Naval  Postgraduate  School  in  Monterey,  California.  This  and  other  academic  research 
tends  to  be  consistent  in  describing  those  factors  that  foster  or  hinder  collaboration. 

In  2004,  the  Police  Executive  Research  Forum  published  its  after-action  analysis 
of  the  2002  DC  Sniper  investigation.  The  report  was  created  after  extensive  interviews 
with  key  personnel  and  focus  groups  (of  which  the  writer  was  a  member)  involved  in  the 
investigation.  The  report  noted  conclusions  and  recommendations  in  a  number  of  areas, 
including  collaboration,  communication,  command,  task  forces,  command  posts, 
technology,  roles  and  responsibilities,  leadership,  and  the  use  of  federal  resources. 


Much  of  the  literature  on  collaboration  provides  a  consistent  perspective  on  what 
factors  help  or  hinder  collaboration.  These  factors  can  be  grouped  into  three  basic  areas: 

1 .  leadership  skills; 

2.  technology;  and 

3.  structural  or  institutional  support. 


a.  Leadership  Skills 

Not  surprisingly,  the  personal  skills,  traits,  and  attitudes  that  were 
identified  as  fostering  collaboration  were  those  dealing  with  power-sharing,  trust, 
motivation,  flexibility,  communication,  consensus  decision  making,  information-sharing, 
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building  social  capital,  having  team  pride,  taking  ownership  of  outcomes,  and  the 
perceived  need  to  collaborate. 

b.  Technology 

The  right  technology  used  in  the  right  manner  also  facilitates 
collaboration.  Technology  that  promotes  infonnation-sharing  and  is  interoperable, 
scalable,  flexible,  adaptable,  secure,  and  affordable  is  the  kind  of  technology  that  will 
foster  a  more  collaborative  working  environment.  However,  technology  by  itself,  without 
the  requisite  leadership  skills  and  structural  support,  is  not  sufficient  to  maintain  a 
collaborative  environment. 

c.  Structural  Support 

The  kind  of  structural  support  that  promotes  successful  collaboration  is 
centered  in  planning,  training,  funding,  and  working  in  collaborative  events.  Planning 
includes  those  activities  that  support  NIMS,  the  National  Response  Framework,  strategic 
planning,  regional  communications  planning,  a  clear  purpose  and  mission,  and  the 
establishment  of  formal  and  mandated  systems  for  roles  and  responsibilities.  Training 
activities  are  those  that  provide  instruction  on  leadership,  technology,  and  structural 
support  processes.  Collaborative  events  include  real-world  incidents,  social  meetings, 
training,  and  multidisciplinary  exercises.  Funding,  especially  from  federal  grants,  is 
necessary  to  support  all  of  the  above  activities. 

There  was  nothing  controversial  in  the  literature  about  collaboration; 
however,  the  literature  did  provide  information  about  factors  that  promote  and  hinder 
collaboration,  which  will  be  used  to  lay  a  foundation  in  this  paper  for  fostering  successful 
collaborative  processes. 

5.  Incident  Command 

a.  National  Incident  Management  System  (NIMS) 

According  to  HSPD-5  and  NIMS,  NIMS  is  the  prescribed  system  for 
managing  emergency  incidents  and  preplanned  events  in  the  United  States  (White  House, 


13 


2003,  p.  1)  (DHS,  2008a,  p.  3).  The  Department  of  Homeland  Security’s  2008  National 
Incident  Management  System  (NIMS)  outlines  the  tenets  of  NIMS,  and  there  are  a 
number  of  FEMA-sponsored  online  and  classroom  NIMS  training  programs  (e.g.,  IS- 1 00, 
IS-700,  ICS-200,  ICS-300,  ICS-400).  There  are  articles  supporting  the  usefulness  of 
NIMS,  but  there  was  no  apparent  documentation  for  how  NIMS  has  been  used 
specifically  to  coordinate  regional  LE  investigations.  The  FBI  investigative  management 
model  does  not  follow  the  NIMS  model;  however,  that  is  not  a  concern  in  this  paper. 

b.  Gold-Silver-Bronze 

The  incident  management  system  used  in  the  United  Kingdom  (UK)  is 
called  the  “Gold-Silver-Bronze.”  This  model  is  outlined  in  various  documents  issued  by 
the  UK  central  government  and  incorporated  into  inter-disciplinary  emergency  response 
plans  for  disaster  response  agencies  in  London  Examples  include:  (1)  Emergency 
Response  and  Recovery  (HM  Government  of  the  United  Kingdom,  2010);  (2)  Responding 
to  Emergencies :  The  UK  Central  Government  Response  Concept  of  Operations  (Cabinet 
Office,  2010);  and  (3)  Major  Incident  Procedure  Manual  (London  Emergency  Services 
Liaison  Panel,  2007). 

Both  the  NIMS  and  Gold-Silver-Bronze  incident  management  models 
have  strengths  and  weaknesses.  An  analysis  of  the  literature  shows  that  the  weaknesses 
contained  in  each  model  can  be  bolstered  by  substituting  its  key  counterpart  from  the 
other  model.  Analyzing  the  strengths  of  each  model  can  be  very  useful  in  fonnulating  a 
regional  investigative  incident  management  model. 

F.  METHOD 

1.  Delphi  Survey 

The  Delphi  method  of  research  uses  subject  matter  experts  (SMEs)  to  provide 
expert  opinions  on  issues  that  lend  themselves  to  subjective  expert  judgment  when 
available  infonnation  is  limited.  Among  other  purposes,  the  Delphi  method  is  used  to 
explore  planning  options  relating  to  interagency  collaboration,  which  is  the  central  theme 
of  this  paper.  The  characteristics  of  the  Delphi  method  are: 
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1 .  it  uses  an  iterative  process  of  multi-round  surveys  to  facilitate 
communication  among  an  anonymous  group  of  subject  matter  experts 
(SMEs)  around  a  complex  problem; 

2.  it  elicits  opinions  from  SMEs;  and 

3.  the  anonymity  afforded  to  the  SMEs  allows  them  to  voice  their  opinions 
more  fully  and  openly  (Rowe  &  Wright,  1999,  p.  354). 

The  input  provided  by  the  SMEs  can  foster  buy-in  from  the  involved  agencies  and 
disciplines  for  the  recommendations  emanating  from  the  research. 

The  first  round  of  interviews  often  uses  a  structured  set  of  questions.  After 
obtaining  input  from  the  SMEs,  the  researcher  identifies  similar  themes  espoused  by  the 
SMEs.  The  researcher  then  develops  a  questionnaire  for  a  second  round  of  interviews  that 
should  build  upon  the  responses  from  the  first  round.  This  process  continues  until  a 
consensus  is  reached  by  the  Delphi  panel.  Three  rounds  of  interviews  are  typical  for  a 
Delphi  study  but  more  can  be  conducted,  if  necessary. 

The  Delphi  method  was  used  to  conduct  the  research  for  this  paper  since  it  would 
allow  for  solicitation  of  input  from  key  SME  stakeholders  in  multiple  NCR  jurisdictions 
and  disciplines,  and  it  would  thereby  engender  a  higher  level  of  buy-in  from  those 
agencies.  The  writer  used  the  input  provided  by  these  SMEs,  along  with  information  from 
other  sources  and  his  own  analysis,  to  craft  recommendations  for  conducting  regional  LE 
investigations  that  would  likely  have  a  broad  range  of  support  in  the  NCR. 

The  writer  chose  13  of  the  19  Delphi  Panel  members  from  local  and  federal  LE 
agencies  because  of  the  law-enforcement-centric  nature  of  this  research.  He  chose  not  to 
include  SMEs  from  state  police  agencies  because  they  do  not  have  primary  investigative 
responsibilities  within  the  Maryland  and  Virginia  NCR  jurisdictions;  however,  the  state 
police  agencies  do  have  significant  representation  in  the  northern  Virginia  and  Maryland 
fusion  centers.  Since  three  state  and  local  fusion  centers  serve  the  NCR,  the  writer 
allotted  one  representative  from  each  center  to  serve  on  the  Delphi  panel.  The  writer 
allotted  two  representatives  from  fire/EMS  and  one  representative  from  the  public 
information  functions. 


15 


To  identify  appropriate  members  of  the  Delphi  panel  who  could  speak  for  their 
agencies  and/or  discipline,  the  writer  solicited  SME  recommendations  from  the 
chairpersons  of  the  primary  NCR  committees  representing  LE  (R-ESF  #13  Police  Chiefs 
Committee),  lirc/EMS  (R-ESF  #4  Fire  Chiefs  Committee),  and  public  infonnation  (R- 
ESF  #15  External  Affairs  Committee).  To  represent  the  three  fusion  centers,  the  writer 
solicited  similar  recommendations  from  the  director  or  deputy  director  of  each  center. 

The  chair  of  the  Fire  Chiefs  Committee  recommended  two  senior  fire/EMS  chief 
officers  from  two  major  NCR  fire  departments.  The  chair  of  the  External  Affairs 
Committee  recommended  a  public  infonnation  officer  (PIO)  serving  as  the  senior  PIO  in 
a  major  NCR  jurisdiction.  In  addition,  the  directors  of  the  three  fusion  centers  each 
recommended  senior  officials  from  their  agencies  to  represent  their  discipline.  Finally, 
the  Police  Chiefs  Committee  decided  that  each  NCR  LE  agency  would  make  its  own 
recommendations  for  who  should  represent  the  individual  departments. 

Since  there  are  many  federal  and  local  LE  agencies  in  the  NCR,  for  practical 
reasons,  the  writer  limited  the  number  of  SMEs  that  would  represent  the  LE  discipline  on 
the  Delphi  panel.  Since  the  FBI  is  the  lead  federal  agency  for  terrorism  investigations  and 
routinely  provides  support  to  NCR  local  LE,  the  writer  solicited  recommendations  from 
senior  FBI  personnel  from  each  of  the  two  FBI  field  offices  that  serve  the  NCR:  the 
Baltimore  Field  Office  (BFO)  and  Washington  Field  Office  (WFO).  The  writer  followed 
the  same  procedure  for  the  primary  LE  agencies  representing  the  eight  major  NCR 
jurisdictions.  To  obtain  the  perspective  and  input  from  smaller  local  LE  agencies,  the 
writer  chose  two  police  departments  from  a  municipality  and  a  town  located  within  a 
primary  NCR  jurisdiction.  And  finally,  the  writer  solicited  the  participation  of  one  of  the 
incident  commanders  who  led  the  investigative  response  in  the  DC  Sniper  case. 

All  of  the  recommended  SMEs  agreed  to  participate  in  the  Delphi  panel.  Their 
identities  have  been  kept  confidential,  even  to  each  other.  The  Delphi  panel  consisted  of 
19  SMEs  representing  the  following  agencies  and  disciplines: 

Eight  representatives  from  the  primary  LE  agencies  of  the  eight  major  NCR 
jurisdictions: 
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•  Metropolitan  Police  Department  (DC) 

•  Alexandria  Police  Department  (VA) 

•  Arlington  County  Police  Department  (VA) 

•  Fairfax  County  Police  Department  (VA) 

•  Loudoun  County  Sheriffs  Office  (VA) 

•  Prince  William  County  Police  Department  (VA) 

•  Montgomery  County  Police  Department  (MD) 

•  Prince  George’s  County  Police  Department  (MD) 

Two  representatives  from  a  municipal  and  a  township  police  department: 

•  Takoma  Park  Police  Department  (MD,  located  within  Montgomery 
County) 

•  Leesburg  Police  Department  (VA,  located  within  Loudoun  County) 

Two  Federal  Bureau  of  Investigation  (2  offices): 

•  Baltimore  Field  Office  (Covers  Montgomery  and  Prince  George’s 
Counties) 

•  Washington  Field  Office  (Covers  D.C.  and  northern  Virginia  jurisdictions) 
Three  representatives  from  the  three  fusion  centers  serving  the  NCR: 

•  Maryland  Coordination  and  Analysis  Center  (MD) 

•  Washington  Regional  Threat  Analysis  Center  (DC) 

•  Northern  Virginia  Regional  Intelligence  Center  (VA) 

Two  fire/EMS  representatives  from  two  jurisdictions: 

•  Montgomery  County  Fire  and  Rescue  Services 

•  District  of  Columbia  Fire  Department 

One  public  information  officer  (The  name  of  the  specific  jurisdiction  is  being 
withheld  to  maintain  the  confidentiality  of  this  SME.) 

One  Retired  LE  executive  officer  who  served  as  an  investigative  incident 
commander  during  the  DC  Sniper  case  investigation. 

For  the  first  round,  the  writer  interviewed  each  of  the  Delphi  panel  members  at 

his/her  place  of  employment  or  home  using  a  standard  questionnaire  that  had  been 

emailed  to  them  several  days  prior  to  the  interview.  (See  the  appendix  for  a  list  of  the 

Delphi  panel  questions.)  The  writer  audio  recorded  the  interviews  and  transcribed  the 
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audio  into  typewritten  notes.  After  the  first  round  was  completed,  the  writer  identified 
themes  common  to  most  of  the  SMEs.  These  themes  centered  on  things  the  SMEs 
thought  promote  or  hinder  collaboration  and  trust,  incident  management,  joint  operations 
centers  (JOC)  and  networks,  information- sharing  technology,  and  the  integration  of  other 
disciplines  into  the  investigative  model.  Because  the  SMEs  were  in  such  close  agreement 
on  the  primary  themes  of  the  research  after  the  first  interview,  it  became  apparent  that  a 
second  and  much  shorter  interview  would  complete  the  Delphi  research  process. 

The  writer  compiled  a  list  of  the  common  themes  and  all  other  comments  made  by 
the  SMEs  in  a  Word  document  table.  There  were  189  separate  comments  listed  that 
ranged  from  a  comment  made  by  just  one  SME  to  comments  made  by  all  the  SMEs. 
Adjacent  to  each  comment,  the  writer  listed  the  number  of  SMEs  who  had  made  a  similar 
comment  (e.g.,  “one,”  “some,”  “many,”  “most,”  and  “all”).  The  writer  emailed  these 
tables  to  the  SMEs  and  asked  them  to  review  each  of  the  comments  and  determine  if  they 
“agree,”  “disagree,”  or  are  “undecided,”  about  the  comment.  Some  of  the  SMEs  emailed 
the  tables  back  to  the  writer  with  their  responses  while  others  gave  the  writer  their  input 
in  a  telephone  interview.  A  third  round  of  interviews  was  not  necessary  because 
consensus  on  the  fundamental  issues  had  been  achieved  by  the  end  of  the  first  round  of 
interviews,  while  the  second  round  provided  some  additional  insight  into  the  central 
themes. 

The  subject  matter  experts  of  the  Delphi  panel  provided  valuable  input  relating  to 
the  central  issues  involved  in  planning  for  a  regional  investigation.  There  was  a  high  level 
of  agreement  between  federal  and  local  LE  agencies  and  between  the  four  disciplines 
represented  in  the  panel.  The  LE  SMEs  were  in  agreement  about  the  need  to  create  a  plan 
for  regional  investigations,  as  well  as  some  general  recommendations  for  an  investigative 
framework.  The  non-LE  SMEs  provided  insight  into  how  their  disciplines  could  support 
an  investigation. 

G.  SIGNIFICANCE  OF  RESEARCH 

This  research  examines  some  of  the  foremost  issues  relating  to  multiple  agencies 
and  disciplines  working  collaboratively  on  an  investigation.  These  issues  are: 
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1 .  identifying  those  things  that  foster  and  hinder  collaboration; 

2.  identifying  how  the  investigation  will  be  managed; 

3.  identifying  when  the  investigation  will  be  managed  from  a  JOC  vs.  a 
network  of  command  posts; 

4.  identifying  the  type  of  technology  that  will  support  a  network 
investigation;  and 

5.  identifying  how  other  disciplines  can  assist  in  a  LE  investigation. 

There  are  existing  templates  to  assist  in  constructing  this  investigative  model.  The 
Police  Executive  Research  Forum  PERF  report  contains  many  reasonable  lessons-leamed 
and  recommendations  that  can  be  incorporated  into  the  NCR  investigative  framework 
(Murphy  &  Wexler,  2004).  Furthermore,  NIMS  and  the  UK’s  incident  management 
models  are  systems  for  managing  all-hazards  responses.  The  challenge  will  be  to 
demonstrate  how  these  can  be  integrated  to  establish  a  preplanned  investigative 
organizational  framework  to  manage  a  regional  investigation. 

1.  To  the  Literature 

Pattern  crimes  spanning  multiple  jurisdictions  are  common  problems  for  LE  (e.g., 
commercial  burglaries  and  anned  robberies,  sexual  offenses,  auto  thefts,  burglaries  of 
wealthy  residential  neighborhoods,  and  occasionally  murders).  Incidents  such  as  the  DC 
Sniper  case  are  an  infrequent  occurrence,  but  they  have  a  high  impact  regionally.  This 
paper  will  help  to  fill  in  the  gaps  in  the  literature  for  coordination  of  regional 
investigations  by  applying  the  lessons-learned  from  the  DC  Sniper  investigation,  using 
the  NIMS/ICS  model  as  applied  to  the  management  of  regional  investigations,  and 
incorporating  other  non-LE  emergency  support  functions  into  a  regional  LE 
investigation. 

2.  To  Future  Research  Efforts 

This  paper  could  spawn  additional  research  into  shaping  specific  command, 
communication,  coordination,  and  data-sharing  protocols  for  a  multijurisdictional  LE 
investigation  in  the  NCR.  Conducting  an  investigation  in  a  network  of  command  posts 
model  rather  than  in  a  single  joint  operations  center  poses  significant  communication  and 
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coordination  technology  challenges.  The  merits  of  each  model  could  be  analyzed  in  an 
after-action  review  of  regional  investigations  using  the  different  models. 

3.  To  the  National  Capital  Region 

By  creating  a  framework  for  regional  investigations  and  using  the  model  to 
conduct  the  investigation  of  less-serious  crimes,  local  LE  will  be  better  prepared  to  mount 
an  effective  investigative  response  to  critical  regional  crimes  like  the  DC  Sniper  case.  It 
is  helpful  if  regional  partners  understand  the  capabilities  of  all  the  partners  and  the 
expectations  between  agencies  and  different  levels  of  government.  Mutual  aid 
agreements  (MAAs)  and/or  memoranda  of  understanding  (MOUs)  are  sometimes  used  to 
communicate  these  capabilities  and  expectations. 

This  paper  will  provide  the  R-ESF  #13  Police  Chiefs  Committee  with  specific 
planning  recommendations  for  developing  a  framework  for  conducting  regional 
investigations.  These  recommendations  are  in  alignment  with  NCR  priority  goals  as 
outlined  in  the  NCR  Homeland  Security  Strategic  Plan  2010,  and  with  a  variety  of 
federal  and  regional  documents  that  emphasize  the  need  to  work  in  collaboration  to 
address  common  problems. 

4.  Homeland  Security  Practitioners  and  Leaders  Nationally 

This  paper  may  serve  as  a  guiding  light  for  how  other  jurisdictions  can  plan  for 
collaborative  regional  LE  investigations.  It  may  prompt  LE  leaders  to  consider  leveraging 
the  capabilities  of  other  disciplines  to  assist  in  the  investigation  and  using  NIMS  to 
manage  a  large  number  of  investigative  resources  from  multiple  agencies. 

5.  Preparedness  Concepts  from  the  Department  of  Homeland  Security 
(DHS) 

Since  this  paper  addresses  intergovernmental  and  interagency  investigative 
response  preparedness  activities,  it  is  important  that  these  actions  take  place  within  the 
context  of  the  preparedness  guidelines  and  framework  established  by  Presidential  Policy 
Directive  8  (White  House,  2011)  and  the  National  Response  Framework  (DHS,  2008b). 
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a.  Presidential  Policy  Directive  8  (PPD-8) 

In  2011,  President  Barack  Obama  issued  PPD-8  to  strengthen 
preparedness  activities  in  the  United  States  to  address  risks  associated  with  the  most 
serious  threats  to  the  country  (White  House,  2011,  p.  1).  The  document  defines  national 
preparedness  as,  “The  actions  taken  to  plan,  organize,  equip,  train,  and  exercise  to  build 
and  sustain  the  capabilities  to  prevent,  protect  against,  mitigate  the  effects  of,  respond  to, 
and  recover  from  those  threats  that  pose  the  greatest  risk  to  the  security  of  the  Nation 
(White  House,  2011,  p.  5).”  There  are  three  main  components  associated  with  the 
implementation  of  PPD-8:  1):  the  national  preparedness  goal;  2)  core  capabilities;  and  3) 
a  national  preparedness  system  (White  House,  201 1,  p.  1). 

The  National  Preparedness  Goal  defines  the  goal  as,  “A  secure  and 
resilient  nation  with  capabilities  required  across  the  whole  community  to  prevent,  protect 
against,  mitigate,  respond  to,  and  recover  from  the  threats  and  hazards  that  pose  the 
greatest  risk”  (DHS,  2011,  p.  1).  As  with  Homeland  Security  Presidential  Directive  8, 
issued  in  2003,  PPD-8  emphasizes  a  capabilities-based  planning  approach  (White  House, 
2011,  p.  1-2).  There  are  35  core  capabilities  that  support  the  five  homeland  security 
missions  of  prevention,  protection,  mitigation,  response,  and  recovery  (DHS,  201 1,  p.  2). 
The  core  capabilities  build  upon  and  replace  the  37  capabilities  listed  in  the  target 
capabilities  list,  which  was  established  during  the  George  W.  Bush  administration  (DHS, 
2011,  p.  3),  and  will  evolve  with  time  as  new  challenges  arise  (DHS,  2011,  p.  1).  The 
NCR  must  develop  the  following  core  capabilities  to  support  successful  regional 
investigations: 

•  Operational  Coordination:  “Establishes  and  maintains  a  unified  and 
coordinated  operational  structure  and  process  that  appropriately  integrates 
all  critical  stakeholders  and  supports  the  execution  of  Core  Capabilities.” 
(DHS,  201 1,  p.  5) 

•  Public  Information  and  Warning:  “Deliver  coordinated,  prompt,  reliable, 
and  actionable  information  to  the  whole  community  through  the  use  of 
clear,  consistent,  accessible,  and  culturally  and  linguistically  appropriate 
methods  to  effectively  relay  information  regarding  any  threat  or  hazard,  as 
well  as  the  actions  being  taken  and  the  assistance  being  made  available,  as 
appropriate.”  (DHS,  201 1,  p.  5) 
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•  Intelligence  and  Information-sharing:  “Provide  timely,  accurate,  and 
actionable  information  resulting  from  the  planning,  direction,  collection, 
exploitation,  processing,  analysis,  production,  dissemination,  evaluation, 
and  feedback  of  available  infonnation  concerning  threats  to  the  United 
States,  its  people,  property,  or  interests;  the  development,  proliferation,  or 
use  of  WMDs;  or  any  other  matter  bearing  on  the  U.S.  national  or 
homeland  security  by  Federal,  state,  local,  and  other  stakeholders. 
Infonnation-sharing  is  the  ability  to  exchange  intelligence,  infonnation, 
data,  or  knowledge  among  Federal,  state,  local,  or  private  sector  entities, 
as  appropriate.”  (DHS,  201 1,  p.  6) 

•  Planning:  “Conduct  a  systematic  process  engaging  the  whole  community 
as  appropriate  in  the  development  of  executable  strategic,  operational, 
and/or  community-based  approaches  to  meet  defined  objectives.”  (DHS, 
2011,  p.  5) 

•  Operational  Communications:  “Ensure  the  capacity  for  timely 

communications  in  support  of  security,  situational  awareness,  and 
operations  by  any  and  all  means  available,  among  and  between  affected 
communities  in  the  impact  area  and  all  response  forces.”  (DHS,  2011,  p. 
14) 

•  Situational  Assessment:  “Provide  all  decision  makers  with  decision¬ 
relevant  information  regarding  the  nature  and  extent  of  the  hazard,  any 
cascading  effects,  and  the  status  of  the  response.”  (DHS,  201 1,  p.  15) 

According  to  the  Department  of  Homeland  Security,  “The  National 

Response  Framework  (NRF)  is  a  guide  for  how  the  nation  will  conduct  all-hazards 

response”  (DHS,  2008b,  p.  i).  The  NRF  is  organized  into  five  main  sections:  1)  Core 

document;  2)  Emergency  Support  Function  Annex;  3)  Support  Annexes;  4)  Incident 

Annexes;  and  5)  Partner  Guides  (DHS,  2008b,  p.  3-4).  The  National  Incident 

Management  System  (NIMS)  is  a  companion  document  that  presents  standardized 

management  tools  as  a  national  template  for  response  actions  (DHS,  2008b,  p.  4). 

The  NRF  core  document  strongly  supports  the  development  of  a  regional 
investigative  plan  by  stressing  that  senior  leaders  should  build  the  basis  for  an  effective 
response  and  should  organize  and  integrate  their  capabilities  with  regional  partners  (DHS, 
2008b,  p.  5).  Five  essential  principles  of  the  response  doctrine  outlined  in  the  NRF  core 
plan  are: 

1 .  engaged  partnerships; 

2.  tiered  response; 
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3.  scalable,  flexible,  and  adaptable  operational  capabilities; 

4.  unity  of  effort  through  unified  command;  and 

5.  a  readiness  to  act  (DHS,  2008b,  p.  8). 

Planning  for  constructing  a  regional  investigative  model  should 
incorporate  these  five  fundamental  NRF  principles.  Since  engaged  partnerships  are  vital 
to  preparedness,  preparedness  activities  should  be  coordinated  both  within  jurisdictions 
and  regionally  (DHS,  2008b,  p.  9).  Incidents  must  be  managed  at  the  lowest  jurisdictional 
level  possible;  however,  when  additional  assistance  is  required,  it  should  be  a  tiered 
response  that  may  include  neighboring  jurisdictions,  the  state,  and  the  federal  government 
(DHS,  2008b,  p.  10).  The  scope  of  an  incident  will  determine  the  appropriate  response 
level  (DHS,  2008b,  p.  10).  Plans  must  be  flexible  and  scalable  to  meet  the  response 
requirements  that  will  be  partially  determined  by  the  type  and  number  of  incidents,  the 
gravity  of  the  incidents,  and  the  geographical  magnitude  of  the  incidents  (DHS,  2008b,  p. 
10).  Unity  of  effort  through  unified  command  is  crucial  to  response  activities;  therefore, 
leaders  should  employ  the  Incident  Command  System  (ICS)  to  manage  a 
multijurisdictional  or  multiagency  incident  (DHS,  2008b,  p.  10).  A  readiness  to  act 
depends  on  the  ability  to  communicate  and  the  processes,  procedures,  and  systems  to 
support  it  (DHS,  2008b,  pp.  10-1 1). 


The  Preparedness  Cycle  Builds  Capabilities 
Figure  2.  The  Preparedness  Cycle  (From  DHS,  2008b,  p.  27) 
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The  NRF  recognizes  that  a  strong  commitment  to  preparedness  is  essential 
for  an  effective  response.  The  NRF  promotes  a  preparedness  cycle  that  includes  (DHS, 
2008b): 

•  Developing  detailed  and  robust  plans  that  define  decision  making 
procedures  and  leadership  roles  and  responsibilities,  among  other  things 
(P-  28); 

•  Organizational  structures  and  a  management  system  to  manage  the 
response  (p.  29); 

•  Training  to  support  operations  (p.  3 1); 

•  Securing  the  proper  equipment  and  technology  necessary  for  an  effective 
response  (p.  29); 

•  Planning,  conducting,  and  evaluating  multijurisdictional  and 

multidisciplinary  exercises  to  validate  the  planning,  systems,  training,  and 
equipment  (p.  31);  and 

•  Establishing  an  evaluation  and  improvement  planning  process  that 
incorporates  lessons-learned  back  into  the  planning  process  (p.  32). 

The  Emergency  Support  Function  (ESF)  Annex  describes  the  role  of  ESFs 

as  providing: 

...  the  structure  for  coordinating  Federal  interagency  support  for  a  Federal 
response  to  an  incident.  They  are  mechanisms  for  grouping  functions  most 
frequently  used  to  provide  Federal  support  to  States  and  Federal-to- 
Federal  support,  both  for  declared  disasters  and  emergencies  under  the 
Stafford  Act  and  for  non-Stafford  Act  incidents  (DHS,  2008c,  p.  i).  The 
Regional  Emergency  Support  Function  (R-ESF)  structure  of  the  NCR  as 
described  in  the  NCR  Homeland  Security  Strategic  Plan  Appendices 
closely  reflects  the  federal  ESF  structure  (Metropolitan  Washington 
Council  of  Governments.  [MWCOG],  2010b,  pp.  B5-7) 

One  of  the  NRF  incident  annexes  is  the  Terrorism  Incident  Law 
Enforcement  and  Investigation  Annex  (DHS,  2008c).  This  annex  identifies  the  FBI  as 
being  the  lead  agency  for  criminal  investigation  of  terrorism  incidents,  and  it  describes 
the  concept  of  the  federal  joint  operations  center  as  the  structure  to  manage  the  incident 
(DHS,  2008c,  p.  TER3-14). 

The  recommendations  for  generating  a  regional  investigative  model  listed 
in  Chapter  VIII  dovetail  closely  with  national  readiness  priorities  by  focusing  on 
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enhancing  capabilities  consistent  with  DHS’s  core  capabilities,  operating  within  the 
guidelines  of  the  NRF,  and  supporting  both  regional  and  national  priorities. 

This  chapter  has  identified  the  problem  of  not  having  a  framework  for 
regional  local  law  enforcement  investigations  in  the  National  Capital  Region  and  some  of 
the  principal  questions  that  need  to  be  answered  to  create  a  useful  model.  The  FBI 
already  has  a  model  for  such  investigations  at  the  federal  level;  however,  local  LE 
agencies  need  to  design  their  own  model  to  ensure  that  a  regional  investigation  conducted 
by  local  LE  is  done  in  an  efficient  and  effective  manner.  There  is  a  plethora  of 
information  in  the  literature  relating  to  collaboration,  leadership,  national  management 
models,  and  lessons-leamed  from  other  multijurisdictional  and  intergovernmental 
investigations,  especially  the  DC  Sniper  case  of  2002. 

Since  it  is  important  that  NCR  personnel  working  within  a 
multijurisdictional  investigation  understand  the  issues  involved  in  crafting  a  suitable 
investigative  model  and  have  a  stake  in  designing  such  a  model,  the  primary  research  in 
this  paper  utilizes  a  Delphi  survey  of  key  NCR  SMEs  from  several  disciplines  that  would 
ultimately  function  within  the  model.  The  creation  of  a  regional  investigative  framework 
dovetails  nicely  with  the  U.S.  Department  of  Homeland  Security’s  emphasis  on 
preparedness,  enhancing  capabilities,  and  using  NIMS.  The  significance  of  this  research 
could  be  pivotal  not  only  the  NCR  but  also  for  other  regions  in  the  country  that  may  need 
regional  investigative  solutions.  This  chapter  has  provided  some  insight  into  the  structure 
and  ongoing  collaborative  efforts  of  the  National  Capital  Region;  however,  the  next 
chapter  will  more  thoroughly  examine  how  the  NCR  is  both  a  fragmented,  yet  unified 
region. 
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II.  THE  NATIONAL  CAPITAL  REGION 


The  National  Capital  Region  is  a  unique  region  for  both  national  and  international 
reasons.  Politically,  it  not  only  houses  the  three  branches  of  the  national  government,  but 
it  also  wields  influence  worldwide.  Natural  or  manmade  catastrophes  (e.g.,  the  DC  Sniper 
case)  could  not  only  have  a  significant  and  cascading  impact  on  the  region  but  also  on  the 
national  and  international  fronts.  The  region  is  comprised  of  many  jurisdictions  from  two 
states  and  the  District  of  Columbia.  There  are  forces  that  unify  the  region,  but  there  are 
also  forces  that  divide  the  region.  This  chapter  will  examine  some  of  these  forces  and 
demonstrate  that  while  there  are  structural  divisions  within  the  NCR,  there  are  also 
unifying  configurations  that  make  collaboration  on  crafting  a  regional  investigative 
framework  not  only  possible  but  desirable. 
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Figure  3.  The  National  Capital  Region  (From  FEMA,  2012) 
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The  National  Capital  Region  (NCR)  was  created  by  the  National  Capital 
Planning  Act  of  1952,  40  USC  71  and  is  a  federally  recognized  region  comprised  of  18 
jurisdictions  that  include  Washington,  D.C.,  and  the  surrounding  counties  and 
incorporated  cities  from  Maryland  and  Virginia  (FEMA,  2012).  There  are  eight  major 
jurisdictions,  while  the  remaining  10  jurisdictions  are  incorporated  cities  within  parent 
counties  (MWCOG,  2010a).  The  NCR  jurisdictions  are: 

•  Washington,  D.C. 

•  Maryland:  Montgomery  County  and  the  incorporated  cities  of 
Gaithersburg,  Rockville,  and  Takoma  Park;  and  Prince  Georges  County 
and  the  incorporated  cities  of  Bowie,  College  Park,  and  Greenbelt. 

•  Virginia:  Alexandria  (city);  Arlington  County;  Loudon  County;  Fairfax 
County  with  its  incorporated  cities  of  Falls  Church  and  Fairfax  City;  and 
Prince  William  County  with  its  incorporated  cities  of  Manassas  and 
Manassas  Park.  (MWCOG,  2010a) 

With  2,500  square  miles  and  a  population  of  over  five  million,  the  NCR  is  the 
fourth  largest  metropolitan  area  in  the  country  (MWCOG,  2010a,  p.  4).  It  has  a  gross 
regional  product  of  $288.3  billion,  fourth  largest  in  the  nation  (MWCOG,  2010a,  p.  4).  It 
is  home  to  271  federal  departments  and  agencies;  340,000  federal  employees;  the 
Pentagon;  all  three  branches  of  the  federal  government;  more  than  40  colleges  and 
universities;  and  more  than  2,000  political,  social,  and  humanitarian  non-profit 
organizations  (MWCOG,  2010a,  pp.  4-5).  In  addition,  20  million  tourists  visit  the  region 
annually,  and  the  number  of  visitors  and  foreign  nationals  residing  in  the  NCR  at  any  one 
time  is  more  than  any  other  metropolitan  area  in  the  country  (MWCOG,  2010a,  pp.  4-5). 
Many  employees  commute  to  work  in  the  NCR  from  the  surrounding  states  of  West 
Virginia  and  Pennsylvania,  as  well  as  from  mid  to  southern  regions  of  Virginia 
(MWCOG,  2010a,  p.  4). 

In  addition  to  large  numbers  of  visitors  and  employees,  the  NCR  contains  major 
transportation  infrastructure  such  as  interstate  highways,  heavy  rail  systems,  two 
international  airports,  many  roadways  and  bridges,  the  second  largest  commuter  rail 
system,  and  the  fifth  largest  bus  system  in  the  United  States  (MWCOG,  2010a,  p.  5). 
From  the  international  perspective,  the  NCR  is  host  to  more  than  170  embassies,  the 
International  Monetary  Fund,  the  World  Bank,  the  Organization  of  American  States,  and 

28 


other  international  entities  (MWCOG,  2010a,  p.  5).  Furthennore,  the  public  schools  of 
just  one  NCR  jurisdiction  teach  students  from  157  countries  speaking  138  different 
languages  (Montgomery  County  Public  Schools,  2012,  p.  1). 

As  far  law  enforcement  goes,  all  of  the  eight  major  NCR  counties  and  cities  have 
police  or  sheriffs  departments  that  provide  the  full  range  of  police  services,  including  the 
investigation  of  serious  felonies  such  as  murders,  sexual  offenses,  and  armed  robberies. 
Some  of  the  smaller  townships  and  incorporated  municipalities  also  have  full-service 
police  departments  that  share  law  enforcement  (LE)  duties  with  the  county’s  primary  LE 
agency.  Other  townships  and  municipalities  provide  some  LE  services  but  do  not  have 
primary  investigative  responsibility  for  serious  felonies.  The  state  police  departments  in 
both  Virginia  and  Maryland  conduct  traffic  operations  on  interstate  highways  and 
designated  state  roads  in  the  NCR,  but  they  do  not  normally  have  criminal  investigative 
responsibilities  within  the  NCR  jurisdictions.  If  requested,  state  police  investigators  will 
respond  to  assist  local  LE  for  a  serious  crime  spree;  however,  neither  state  police  agency 
would  be  the  primary  investigative  agency  in  NCR  jurisdictions. 

For  federal  LE,  the  NCR  is  divided  between  the  Baltimore  and  Washington  Field 
Offices  of  the  FBI.  The  Baltimore  Field  Office  has  investigative  responsibility  for  the 
Maryland  counties  of  Montgomery  and  Prince  Georges  (FBI,  n.d.).  The  Washington 
Field  Office  has  investigative  responsibility  for  Washington,  D.C.,  and  the  northern 
Virginia  jurisdictions  of  Alexandria,  Arlington  County,  Fairfax  County,  Loudoun 
County,  and  Prince  William  County  (FBI,  n.d.). 

Additionally,  three  fusion  centers  serve  the  NCR:  1)  the  Maryland  Coordination 
and  Analysis  Center  (MCAC);  2)  the  Washington  Regional  Threat  Analysis  Center 
(WRTAC)  in  Washington,  D.C.;  and  (3)  the  Northern  Virginia  Regional  Intelligence 
Center  (RIC)  in  Virginia  (DHS,  n.d.). 

The  NCR  is  supported  by  the  Metropolitan  Washington  Council  of  Governments 
(COG  or  MWCOG),  a  regional,  non-governmental,  independent,  and  non-profit 
organization  formed  in  1957  to  facilitate  regional  planning  in  the  Washington,  D.C.,  area 
(MWCOG,  n.d.).  COG  is  supported  by  contributions  from  its  member  jurisdictions, 


29 


grants,  and  donations  (MWCOG,  n.d.).  The  NCR  and  COG  jurisdictions  overlap,  except 
that  COG  encompasses  the  two  additional  counties  of  Frederick  and  Charles  in  Maryland, 
the  incorporated  city  of  Frederick  in  Frederick  County,  and  the  town  of  Bladensburg  in 
Prince  George’s  County  (MWCOG,  n.d.).  Other  COG  membership  includes  members  of 
the  Maryland  and  Virginia  legislatures,  the  U.S.  Senate,  and  the  U.S.  House  of 
Representatives  (MWCOG,  n.d.).  COG’s  mission  is  to: 

Enhance  the  quality  of  life  and  competitive  advantages  of  the  Washington 
metropolitan  region  in  the  global  economy  by  providing  a  forum  for 
consensus-building  and  policy-making;  implementing  intergovernmental 
policies,  plans,  and  programs;  and  supporting  the  region  as  an  expert 
information  resource.  (MWCOG,  n.d.) 

Since  1957,  COG  has  evolved  into  a  structure  that  forms  the  latticework  for  how 
the  NCR  conducts  preparedness  activities  within  the  scope  of  the  National  Response 
Framework  (MWCOG,  2010b,  pp.  B2-7).  COG  supports  the  NCR’s  regional  emergency 
support  functions  (R-ESFs),  which  mirror  FEMA’s  National  Response  Framework  that 
groups  resources  by  functions  (MWCOG,  2010b,  pp.  B5-7).  The  R-ESFs  are  comprised 
of  practitioners  and  subject  matter  experts  (SMEs)  that  coordinate  preparedness  activities 
to  build  the  capabilities  necessary  to  respond  to  and  recover  from  disasters  (MWCOG, 
2010b,  p.  B5).  The  following  are  examples  of  the  R-ESF  lead  committees,  which  can  be 
found  on  the  MWCOG  Committee  Business  website  (n.d.):  the  Fire  Chiefs  Committee 
(R-ESF  #4,  9  and  10),  the  Police  Chiefs  Committee  (R-ESF  #13),  and  the  External 
Affairs  Committee  (R-ESF  #15).  The  R-ESF  committees  report  to  the  Chief 
Administrative  Officers’  Homeland  Security  Executive  Council  (CAO-HSEC),  which  is 
comprised  of  the  Chief  Administrative  Officers  of  the  eight  primary  NCR  jurisdictions 
(MWCOG,  2010b,  p.  B3).  Additional  infonnation  about  the  governance  structures  of 
COG  can  be  found  in  Appendix  B  of  the  NCR  2010  Homeland  Security  Strategic  Plan. 

A.  NCR  HOMELAND  SECURITY  STRATEGIC  PLAN  2010-2013 
(STRATEGIC  PLAN) 

The  NCR  released  its  latest  Homeland  Security  Strategic  Plan  ( Strategic  Plan)  in 
October  of  2010;  it  outlines  the  NCR’s  plan  for  achieving  its  priority  capabilities  over  the 
next  three  to  five  years  (MWCOG,  2010a,  p.  1).  The  Strategic  Plan : 
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...  affirmed  the  National  Capital  Region’s  commitment  to  a  common 
vision  of  working  together  towards  a  safe  and  secure  National  Capital 
Region  to  achieve  its  mission  of  building  and  sustaining  an  integrated 
effort  to  prepare  for,  prevent,  protect  against,  respond  to,  and  recover  from 
‘all  hazards’  threats  or  events.  (MWCOG,  2010a,  p.  1) 

The  NCR  leaders  took  a  capabilities-based  approach  to  planning  in  which  they 
identified  the  risks  faced  by  the  NCR  and  the  capabilities  needed  to  reduce  those  risks, 
using  the  Department  of  Homeland  Security’s  target  capabilities  list  (TCL)  as  a  guiding 
light  (MWCOG,  2010b,  p.  A2).  NCR  leaders  will  link  project  decisions  and  funding 
allocations  to  support  building  those  capabilities  (MWCOG,  2010b,  p.  A2)  that  not  only 
support  regional  preparedness,  but  also  foster  the  growth  of  inter-jurisdictional 
relationships  (MWCOG,  2010b,  p.  C2). 

The  central  themes  of  the  Strategic  Plan  include  community  engagement  and 
regional  collaboration  for  planning  and  decision  making  (MWCOG,  2010a,  p.  1). 
Principal  goals  include  enhancing  regional  capabilities  for  developing  interoperable 
communications  for  voice,  data,  and  video  (MWCOG,  2010a,  p.  7).  They  also  include 
enhancing  infonnation-sharing  and  situational  awareness,  especially  with  the  public,  law 
enforcement  agencies,  and  fusion  centers  (MWCOG,  2010a,  pp.  8-9),  and  regional 
planning,  training,  and  exercising  to  develop,  test,  and  validate  capabilities  (MWCOG, 
2010a,  p.  14).  The  Strategic  Plan  recognizes  that  regional  emergency  support  functions 
(R-ESFs)  are  responsible  for  identifying  preparedness  gaps  and  notifying  appropriate 
NCR  leadership  committees  of  the  need  for  grant  funds  and  other  resources  to  close  those 
gaps  (MWCOG,  2010b,  pp.  B3,  B5).  Federal  grants  have  been  a  significant  source  of 
funding  to  achieve  the  goals  set  out  in  the  Strategic  Plan  (MWCOG,  2010a,  p.  15). 

According  to  the  Strategic  Plan,  R-ESF  #13  “...focuses  on  facility  and  resource 
security;  security  planning;  technical  resource  assistance;  public  safety  and  security 
support;  and  support  for  traffic  and  crowd  control”  (MWCOG,  2010b,  p.  B7).  The  COG 
Police  Chiefs  Committee  is  the  lead  for  R-ESF  #13  and  is  comprised  of  senior  executive 
officers  from  federal,  state,  and  local  LE  agencies  in  the  NCR  (MWCOG,  n.d.).  There  are 
seven  subcommittees  of  the  Police  Chiefs  Committee:  Training,  Intelligence,  Planners, 
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Chaplains,  Technology,  Communications,  and  SWAT  (MWCOG,  n.d.).  There  is  no 
existing  subcommittee  for  investigations. 

The  NCR  Regional  Emergency  Coordination  Plan  (RECP)  is  a  plan  to  enhance 
regional  communications  and  coordination  during  a  disaster,  emergency,  or  incident 
(MWCOG  Task  Force  on  Homeland  Security,  2002,  p.  2).  According  to  the  RECP  R- 
ESF  #13  Annex  (law  enforcement),  the  RECP  contains  scalable  plans  for  each  of  the  R- 
ESFs,  including  R-ESF  #13,  law  enforcement  (MWCOG  Task  Force  on  Homeland 
Security,  2002,  p.  2).  This  annex  commits  LE  to  using  the  Incident  Command  System  to 
coordinate  police  resources  and  responses  when  working  in  a  mutual  aid  capacity 
(MWCOG  Task  Force  on  Homeland  Security,  2002,  p.  13-3).  The  2012  Greater 
Metropolitan  Washington  Area  Police  Mutual  Aid  Operational  Plan  also  strongly 
supports  the  use  of  the  Incident  Command  System  when  working  in  a  mutual  aid  capacity 
(MWCOG  Police  Chiefs  Committee,  2012,  pp.  3,  4,  8,  9,  14). 

The  Regional  Incident  Communications  and  Coordination  System  (RICCS)  is  a 
primary  component  of  the  RECP  (MWCOG,  2010,  p.  2).  The  RICCS  is  a  system  for  intra 
and  inter-R-ESF  communication  and  coordination  for  incidents  or  emergencies  that 
provides  text  messages  and  conference  call  capabilities  to  pre-identified  groups  to 
facilitate  situational  awareness  and  coordination  of  resources  (MWCOG,  2009,  p.  2). 
RICCS  may  be  a  good  way  to  initiate  communication  and  coordination  during  a 
multijurisdictional  LE  investigation;  however,  the  RECP  is  not  designed  for  the  complex 
communication  needs  of  a  prolonged  regional  investigation  (MWCOG  Task  Force  on 
Homeland  Security,  2010,  pp.  12-14).  No  such  long-term  LE  regional  communication, 
coordination,  and  information- sharing  system  exits  in  the  NCR.  This  paper  will  address 
this  issue. 

The  NCR  is  home  to  the  NCR  Incident  Management  Team  (IMT),  a  FEMA  Type 

3  IMT  consisting  of  over  100  members  from  various  NCR  jurisdictions  and  disciplines  to 

include  fire,  EMS,  LE,  emergency  management,  and  public  health  (NCR  Incident 

Management  Team,  n.d.,  p.  1).  The  team  can  provide  a  full  range  of  ICS  functions  and 

can  support  local  jurisdictions  in  the  management  of  large-scale  preplanned  events  and 

incidents  arising  from  terrorism,  crime,  and  natural  disasters  (NCR  Incident  Management 
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Team,  n.d.,  p.  2).  Its  personnel  have  received  extensive  training  in  ICS  command  and 
general  staff  positions,  as  well  as  subunits  under  the  general  staff  positions  (NCR 
Incident  Management  Team,  n.d.,  p.  2).  The  IMT’s  Logistics  Section  is  fully  prepared  to 
stand  up  a  command  post  to  support  a  large  operation.  It  has  the  trained  personnel, 
computers,  copiers,  printers,  smart  boards,  projectors,  and  other  equipment  necessary  for 
a  command  post  (NCR  Incident  Management  Team,  n.d.,  p.  2).  The  Planning  Section  has 
the  capability  for  planning  for  multiple  operational  periods  and  has  over  a  dozen  people 
trained  to  be  a  Planning  Section  Chief  (NCR  Incident  Management  Team,  n.d.,  p.  2).  The 
Finance/Administration  Section  can  document  all  the  costs  associated  with  the  incident, 
and  the  LE/intelligence  element  can  assist  local  LE  agencies  in  the  management  of  an 
investigation  (NCR  Incident  Management  Team,  n.d.,  p.  2).  The  NCR  IMT  has 
experience  in  managing  parts  of  response  and  recovery  operations  in  four  hurricanes  in 
states  bordering  the  Gulf  of  Mexico  (NCR  Incident  Management  Team,  n.d.,  p.  1). 

Within  the  NCR  there  are  several  regional  programmatic  working  groups 
(RPWGs)  consisting  of  practitioners,  policymakers,  and  representatives  from 
government,  civic,  and  private  sectors  (MWCOG,  2010b,  p.  B7).  The  responsibilities  of 
the  RPWGs  include  fdling  gaps  and  coordinating  activities  across  emergency  support 
functions,  and  focusing  attention  on  priority  concerns  (MWCOG,  2010b,  p.  B7).  One  of 
these  RPWGs  is  the  Exercise  and  Training  Operations  Panel  (ETOP),  whose  mission  and 
scope  is  to  establish  and  monitor  a  collaborative  and  regional  approach  to  training  and 
exercises  (MWCOG,  2010b,  p.  B8).  Two  of  the  tasks  associated  with  ETOP’s  mission 
are:  1)  to  develop  and  implement  initiatives  that  focus  on  enhancing  regional  training  and 
exercises  across  the  spectrum  of  federal,  state,  and  local  NCR  partners;  and  to  2)  manage 
an  exercise  and  training  budget  to  support  regional  and  interdisciplinary  training  and 
exercise  initiatives  (MWCOG,  2010b,  p.  B8).  There  is  an  ETOP  subcommittee  of  14 
exercise  and  training  professionals  assigned  to  the  major  NCR  jurisdictions,  the  states  of 
Virginia  and  Maryland,  and  other  smaller  NCR  jurisdictions  to  support  training  and 
exercise  activities  (MWCOG,  2010c,  p.  7). 

The  NCR  is  a  prominent  region  for  national  and  international  reasons.  A  major 
disruption  of  life  in  the  NCR  can  have  cascading  effects  regionally,  nationally,  and 
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internationally.  The  NCR  is  politically  fragmented  in  many  ways — consisting  of  layers  of 
federal,  state,  and  local  governments  encompassing  18  jurisdictions  from  Maryland, 
Virginia,  and  the  District  of  Columbia.  Consequently,  emergency  support  functions  such 
as  LE/intelligence,  fire/EMS,  and  public  infonnation  are  also  fragmented.  There  are, 
however,  regional  structures,  planning  documents,  and  grants  that  support  collaboration 
(e.g.,  MWCOG,  the  NCR,  R-ESFs,  RPWGs,  the  NCR  Homeland  Security  Strategic  Plan, 
federal  grants,  and  others). 

To  understand  the  issues  and  challenges  in  managing  regional  investigations,  the 
NCR  does  not  need  to  start  from  scratch.  Managing  a  Multijurisdictional  Case,  the  after¬ 
action  analysis  of  the  DC  Sniper  case  investigation  published  by  the  Police  Executive 
Research  Forum,  identifies  a  number  of  lessons-learned  from  that  investigation  (Murphy 
&  Wexler,  2004).  The  following  chapter  will  discuss  this  report  and  attempt  to  glean 
wisdom  from  the  experiences  of  those  who  participated  in  that  investigation. 
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III.  LESSONS  LEARNED  FROM  THE  DC  SNIPER  CASE 


From  October  2-21,  2002,  10  people  were  murdered  and  three  more  wounded  by 
rifle  fire  in  a  series  of  attacks  that  came  to  be  known  as  the  DC  Sniper  case.  The 
shootings  occurred  in  five  NCR  jurisdictions  and  two  Virginia  jurisdictions  south  of  the 
NCR  (Murphy  &  Wexler,  2004,  pp.  7-12).  The  suspects’  method  of  operation  was  to 
shoot  innocent  victims  in  very  public  places  using  a  high  powered  rifle,  and  ATF 
ballistics  tests  confirmed  the  linkage  between  most  of  the  shootings  (p.  70).  More  than  30 
federal,  state,  and  local  LE  agencies  participated  in  this  intergovernmental,  interagency, 
and  multijurisdictional  investigation  (Murphy  &  Wexler,  2004,  p.  1).  Local  LE  agencies 
in  the  jurisdictions  that  experienced  shootings  were  the  lead  agencies,  while  state  and 
federal  LE  agencies  provided  massive  support  (Murphy  &  Wexler,  2004,  pp.  36,  38,  39). 

After  the  conclusion  of  the  investigation,  the  Department  of  Justice  contracted 
with  the  Police  Executive  Research  Forum  (PERF)  to  conduct  an  after  action  analysis  of 
the  investigation  (Murphy  &  Wexler,  2004,  p.  3).  Gerard  Murphy  and  Chuck  Wexler 
wrote  the  report  titled  Managing  a  Multijurisdictional  Case:  Identifying  Lessons-learned 
from  the  Sniper  Investigation,  hereafter  referred  to  as  the  PERF  report.  They  collected 
data  for  this  report  by: 

1.  conducting  more  than  100  interviews  with  key  LE  personnel  involved  in 
the  investigation,  including  decision-makers,  chief  executives,  and  other 
leaders; 

2.  conducting  focus  groups  of  others  involved  in  the  investigation; 

3.  reviewing  documents;  and 

4.  visiting  facilities  and  locations.  (Murphy  &  Wexler,  2004,  p.  4) 

A.  TIMELINE  OF  DC  SNIPER  SHOOTINGS 

This  chapter  will  chart  the  timeline  of  the  shootings  to  portray  the  dynamic  nature 
and  scope  of  the  crimes,  and  it  will  present  some  of  the  predominant  lessons-leamed  and 
recommendations  delineated  in  the  report.  The  following  is  a  summary  timeline  of  the 
shootings  and  the  arrest  of  the  responsible  subjects  (Murphy  &  Wexler,  2004). 

•  Day  1:  Wednesday,  October  2,  2002.  Shooting  1:  At  approximately  5:20 
PM,  a  rifle  bullet  was  fired  through  the  front  windows  of  the  Michaels 
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Craft  Store  in  Aspen  Hill,  Montgomery  County,  Maryland,  just  missing  a 
cashier  working  inside  (p.  7). 

•  Day  1:  (continued).  Shooting  2:  At  6:04  PM,  55-year  old  James  Martin 
was  shot  in  the  torso  and  killed  in  the  parking  lot  of  the  Shoppers  Food 
Warehouse  in  Wheaton,  Montgomery  County,  Maryland  as  he  walked 
from  his  vehicle  towards  the  store  (p.  7). 

•  Day  2:  Thursday,  October  3,  2002.  Shooting  3:  At  approximately  7:  41 
AM,  39-year  old  James  Buchannan  was  shot  in  the  torso  and  killed  while 
mowing  grass  at  an  automobile  dealership  in  Rockville,  Montgomery 
County,  Maryland  (p.  7). 

•  Day  2:  (continued).  Shooting  4:  At  approximately  8:12  AM,  54-year  old 
Premkumar  Walekar  was  shot  in  the  torso  and  killed  as  he  pumped  gas 
into  his  taxi  in  Aspen  Hill,  Montgomery  County,  Maryland  (p.  7). 

•  Day  2:  (continued).  Shooting  5:  At  approximately  8:37  AM,  34-year  old 
Sarah  Ramos  was  shot  in  the  head  and  killed  as  she  read  a  book  while 
sitting  on  a  bench  outside  a  store  in  a  small  strip  mall  in  Silver  Spring, 
Montgomery  County,  Maryland  (p.  7). 

•  Day  2:  (continued).  Shooting  6:  At  approximately  9:58  AM,  25-year  old 
Lori  Ann  Lewis-Rivera  was  shot  in  the  torso  and  killed  while  vacuuming 
her  van  at  a  gas  station  in  Kensington,  Montgomery  County,  Maryland  (p. 
8). 

•  Day  2:  (continued).  Shooting  7:  At  approximately  9:20  PM,  72-year  old 
Pascal  Chariot  was  shot  in  the  torso  and  killed  while  walking  along 
Georgia  Avenue  in  Washington,  D.C.,  just  inside  the  border  with 
Maryland  (p.  8). 

•  Day  3:  October  3,  2002.  Shooting  8:  At  approximately  2:30  PM,  43-year 
old  Caroline  Seawell  was  shot  in  the  back  and  wounded  as  she  loaded 
bags  into  her  minivan  in  Fredericksburg,  Spotsylvania  County,  Virginia 
(p.  8).  This  location  is  along  Interstate-95  in  a  county  just  south  of  the 
NCR  jurisdiction  Prince  William  County,  Virginia. 

•  Day  6:  October  7,  2002.  Shooting  9:  At  approximately  8:08  AM,  13-year 
old  Iran  Brown  was  shot  in  the  torso  and  wounded  in  front  of  his  middle 
school  in  Bowie,  Prince  Georges  County,  Maryland  (p.  9). 

•  Day  8:  October  9,  2002.  Shooting  10:  At  approximately  8:18  AM,  53- 
year  old  Dean  Myers  was  shot  in  the  head  and  killed  after  he  pumped  gas 
into  his  car  in  Manassas,  Prince  William  County,  Virginia  (p.  9). 

•  Day  10:  October  9,  2002.  Shooting  11:  At  approximately  9:30  AM,  53- 
year  old  Kenneth  Bridges  was  shot  in  the  torso  and  killed  at  a  gas  station 
in  Fredericksburg,  Spotsylvania  County,  Virginia  (p.  9). 
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•  Day  13:  October  14,  2002.  Shooting  12:  At  approximately  9:15  PM,  47- 
year  old  FBI  Analyst  Linda  Franklin  was  shot  in  the  head  and  killed  as  she 
and  her  husband  were  loading  supplies  in  their  car  in  the  parking  lot  of  a 
Home  Depot  store  in  Falls  Church,  Fairfax  County,  Virginia  (p.  10). 

•  Day  18:  October  19,  2002.  Shooting  13:  At  approximately  7:59  PM,  37- 
year  old  Jeffrey  Hopper  was  shot  in  the  torso  and  wounded  as  he  walked 
with  his  family  from  a  restaurant  to  his  car  in  Ashland,  Hanover  County, 
Virginia  (p.  10).  This  jurisdiction  is  south  of  the  NCR  and  just  north  of 
Richmond,  Virginia. 

•  Day  2 1 :  October  22,  2002.  Shooting  14:  At  approximately  5:56  AM,  35- 
year  old  Conrad  Johnson,  a  bus  driver  for  the  Montgomery  County 
government,  was  shot  in  the  torso  and  killed  as  he  stood  in  the  doorway  of 
his  bus  in  Silver  Spring,  Montgomery  County,  Maryland  (p.  1 1). 

•  Day  23:  October  24,  2002.  At  approximately  12:54  AM,  a  citizen  spotted 
John  Muhammad  and  Lee  Boyd  Malvo  sleeping  in  their  vehicle  at  a  rest 
stop  off  of  Interstate  70  in  Myersville,  Maryland,  approximately  45  miles 
north  of  Washington,  D.C.,  (p.  12).  Warrants  had  been  issued  for  their 
arrest  the  previous  day  and  a  lookout  was  released  to  the  media  shortly 
thereafter  (p.  12).  At  approximately  3:30  AM,  tactical  teams  from  the  FBI, 
the  Maryland  State  Police,  and  the  Montgomery  County  Police  arrested 
the  suspects  in  their  vehicle  at  the  rest  stop  (p.  12). 

B.  COMPLEXITY  MARKS  THE  INVESTIGATION 

The  first  five  murders  occurred  in  Montgomery  County,  Maryland  in  less  than  16 
hours.  Within  hours,  the  Maryland  State  Police,  the  Baltimore  office  of  the  FBI  and  the 
Bureau  of  Alcohol,  Tobacco,  Firearms,  and  Explosives  (ATF)  offered  assistance  to  the 
Montgomery  County  Police  (Murphy  &  Wexler,  2004,  p.  8).  On  October  7,  the 
Montgomery  County  Chief  of  Police  made  a  fonnal  request  to  the  Department  of  Justice 
for  assistance,  and  within  days  a  joint  operations  center  (JOC)  was  set  up  in  an  office 
building  adjacent  to  the  Montgomery  County  Police  headquarters  (Murphy  &  Wexler, 
2004,  p.  10).  A  JOC  is  a  federal  command  post  established  by  the  ATF  and  FBI  and  used 
to  manage  an  investigation  using  predetennined  procedures  (Murphy  &  Wexler,  2004,  p. 
21).  Hundreds  of  investigators  from  dozens  of  LE  agencies  worked  in  the  JOC  until  the 
investigation  concluded  (Murphy  &  Wexler,  2004,  p.  44). 

While  LE  has  engaged  in  many  task  forces  investigating  high-profile  crimes  or 
serial  crimes,  the  PERF  report  identifies  distinctive  elements  of  the  DC  Sniper 
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investigation  that  heightened  the  challenges  faced  by  law  enforcement  agencies  (Murphy 
&  Wexler,  2004): 

•  Sniper:  Sniper  shootings  are  very  rare  events;  however,  in  this  series  of 
attacks  there  were  six  shootings  of  apparently  random  victims  that 
occurred  within  the  first  24  hours  of  the  spree  (p.  13). 

•  Multiagency  and  intergovernmental:  Dozens  of  federal,  state,  and  local 
law  enforcement  agencies  participated  in  the  investigation  (p.  13). 

•  Ongoing:  Following  the  initial  six  shootings,  there  were  seven  more 
attacks  in  multiple  jurisdictions  over  the  next  19  days  (p.  13).  Law 
enforcement  agencies  had  to  simultaneously  investigate  the  attacks, 
prevent  further  attacks,  respond  to  new  attacks,  and  provide  the  other  law 
enforcement  services  they  normally  provide  (pp.  13-14). 

•  Media  event:  More  than  1,300  media  personnel  from  local,  national,  and 
international  media  organizations  were  onsite  (p.  14).  They  influenced  law 
enforcement  strategies  and  operations  by  revealing  information  they  had 
discovered  about  the  investigation  (p.  14). 

•  Community  fear:  The  sensational  media  coverage  and  the  random  nature 
of  the  shootings  contributed  to  a  high  level  of  fear  felt  by  citizens  (p.  14). 

•  External  pressures:  The  media  and  community  fear  brought  strong 
pressure  on  law  enforcement  to  end  the  shooting  spree  (p.  14).  Many 
national  government  officials  lived  in  the  suspects’  target  area,  and  there 
were  suggestions  by  governmental  leaders  that  the  investigation  be 
transferred  from  local  law  enforcement  to  federal  law  enforcement  (p.  14). 

•  Terrorism:  The  9/11  attack  occurred  the  previous  year  and  there  was 
concern  that  this  shooting  rampage  was  terrorism-related  (p.  14). 

C.  LESSONS  LEARNED? 

The  PERF  report  lists  dozens  of  “lessons-learned”  and  recommendations  to  guide 
law  enforcement  in  preparing  for  similar  investigations  in  the  future;  however,  four 
themes  emerged  as  the  cornerstones  for  conducting  successful  investigations:  1)  Careful 
planning  and  preparation;  2)  defining  roles  and  responsibilities;  3)  managing  information 
efficiently;  and  4)  maintaining  effective  communication  (Murphy  &  Wexler,  2004,  p. 
15).  The  remainder  of  this  chapter  will  discuss  some  of  the  PERF  recommendations 
related  to  planning  for  operations  in  an  intergovernmental,  interagency,  and 
multijurisdictional  task  force. 
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1.  Leadership 

The  PERF  report  examines  the  role  of  leadership  and  the  task  force  structure,  and 
makes  recommendations  for  an  investigative  model  (Murphy  &  Wexler,  2004).  The  law 
enforcement  executive  officers  from  the  involved  agencies  should  decide  who  is  in 
command  of  the  investigation  and  the  scope  of  their  authority  and  decision-making  power 
(Murphy  &  Wexler,  2004,  p.  31).  In  addition  law  enforcement  agencies  should  identify 
and  develop  training  programs  to  teach  managers  the  skills  they  need  to  manage  a  task 
force  (Murphy  &  Wexler,  2004,  p.  32),  including  those  of  managing  a  command  post  or 
joint  operations  center  (pp.  46-47).  Task  force  leaders  should  always  speak  with  one 
voice  (Murphy  &  Wexler,  2004,  p.  31)  as  was  done  by  federal,  state,  and  local  law 
enforcement  agencies  which  established  a  joint  information  center  that  functioned  as  the 
public  infonnation  conduit  for  the  investigation  (Murphy  &  Wexler,  2004,  p.  91). 

2.  Task  Force  Structure 

One  task  force  structure  does  not  necessarily  fit  all  investigations  since  different 
levels  of  governmental  involvement  and  different  phases  of  the  investigation  may  have 
different  operational  requirements  (Murphy  &  Wexler,  2004,  p.  31).  Additionally, 
command  of  the  task  force  should  be  a  unified  command  structure  (e.g.,  the  incident 
command  system)  that  will  facilitate  consensus  decision-making;  and  there  should  be 
definitive  criteria  for  agency  participation  and  leadership  within  unified  command 
(Murphy  &  Wexler,  2004,  p.  32).  The  issue  of  incident  command  participation  and 
structure  is  a  particularly  important  question  to  resolve  since  some  agencies  may  want  to 
become  part  of  incident  command  even  though  they  have  not  had  one  of  the  pattern 
crimes  occur  in  their  jurisdiction,  or  have  they  contributed  many  resources  to  the 
investigation. 

While  the  main  task  force  was  located  in  Montgomery  County,  there  were  four 
other  task  forces  in  the  northern  Virginia  and  central  Virginia  (Murphy  &  Wexler,  2004, 
pp.  21,  114).  When  there  are  multiple  task  forces,  all  task  forces  need  to  communicate 
and  cooperate;  therefore,  a  task  force  coordinator  should  be  appointed  who  will  facilitate 
communications,  information-sharing,  and  investigative  management  (Murphy  & 
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Wexler,  2004,  p.  32).  Furthermore,  task  forces  should  exchange  representatives  and  have 
regular  interaction  with  each  other  (Murphy  &  Wexler,  2004,  p.  32).  Finally,  one  method 
of  providing  task  force  governance  is  to  establish  a  panel  of  law  enforcement  chief 
executives  from  jurisdictions  with  investigative  responsibility  (Murphy  &  Wexler,  2004, 
p.  32).  This  is  a  particularly  good  recommendation  because  its  helps  to  provide  unified 
command  with  support  and  parameters  for  the  investigation.  Additionally,  NIMS 
provides  for  this  governance  feature  in  its  Multiagency  Coordination  Group  (MAC 
Group)  element  of  the  Command  and  Management  component  (U.S.  DHS,  2008a,  p.  67). 

3.  JOCs 

Local  law  enforcement  agencies  should  explore  planning  options  for  pre¬ 
identifying  JOC  locations,  staffing  and  equipping  them,  and  training  personnel  to  manage 
them  (Murphy  &  Wexler,  2004,  pp.  43,  43,  46,  47).  In  addition  to  the  JOC,  local  and  state 
LE  agencies  should  become  familiar  with  federal  resources  that  can  support  a  local 
investigation,  (Murphy  &  Wexler,  2004,  p.  46). 

4.  Working  with  Other  Law  Enforcement  Executives 

Law  enforcement  executives  should  promote  regional  collaboration  for 
establishing  a  model  or  guidelines  for  multijurisdictional  investigations  (Murphy  & 
Wexler,  2004,  p.  33).  Memoranda  of  understanding  (MOU)  and  mutual  aid  agreements 
(MAAs)  should  be  created  prior  to  incidents  to  identify  what  needs  to  be  done  and  how 
agencies  will  work  together  during  a  crisis  (Murphy  &  Wexler,  2004,  p.  33).  Moreover, 
managers  and  others  should  establish  intergovernmental,  interagency,  and  inter- 
jurisdictional  relationships  prior  to  an  incident  to  facilitate  communication,  coordination, 
and  the  sharing  of  resources  (pp.  33,  460).  This  will  help  establish  a  basis  of  personal 
trust  and  respect  in  which  egos  have  to  be  set  aside  (Murphy  &  Wexler,  2004,  p.  1 16).  In 
addition,  preexisting  relationships  can  help  leaders  understand  the  capabilities  of  each 
agencies  and  how  to  access  them  when  needed  (Murphy  &  Wexler,  2004,  p.  46),  and 
these  proved  to  be  critical  to  the  successful  outcome  of  the  case  (p.  5 1). 

When  using  resource  assistance  from  other  agencies,  there  should  be  a  clear 

mission  for  those  resources  and  a  structure  for  managing  them  (Murphy  &  Wexler,  2004, 
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p.  33).  In  addition,  leaders  should  have  a  regular  schedule  for  briefings  stakeholders  both 
inside  and  outside  the  investigation  (Murphy  &  Wexler,  2004,  p.  33).  Using  secure 
phones,  leaders  should  have  an  established  routine  for  conference  calls,  while  specific 
staff  should  be  assigned  to  manage  this  function  since  it  requires  a  great  deal  of 
preparation,  facilitation,  and  follow  up  responsibilities  (Murphy  &  Wexler,  2004,  p.  33). 

5.  Defining  Roles  and  Responsibilities 

The  role  of  investigators  will  be  a  little  different  in  a  large-scale  investigation 
because  they  will  not  have  the  investigative  autonomy  they  normally  have  (Murphy  & 
Wexler,  2004,  p.  59),  and  they  may  be  paired  with  investigators  from  other  agencies  to 
facilitate  cross-agency  communication  and  coordination  (Murphy  &  Wexler,  2004,  p. 
60).  Furthermore,  managers  may  need  to  take  a  more  active  role  in  the  oversight  of  the 
investigation  while  letting  the  investigators  be  investigators  (Murphy  &  Wexler,  2004,  p. 
117).  These  modified  roles  need  to  be  clearly  communicated  to  the  affected  personnel 
(Murphy  &  Wexler,  2004,  p.  31). 

6.  Case  Management 

There  should  be  accountability  to  a  single  command  structure  throughout  the 
investigation  (Murphy  &  Wexler,  2004,  p.  74),  such  as  unified  command.  A  case 
management  system  should: 

...  be  an  electronic  repository  for  all  tips,  leads,  and  information;  be 
compatible  with  systems  in  other  agencies;  be  web-based  and  accessible  to 
authorized  agencies;  feed  multiple  info  systems  with  one-time  entry; 
perfonn  sophisticated  data  analysis  such  as  cross  checking  and 
soundexing;  and  provide  action  tasks  for  investigators.  (Murphy  & 

Wexler,  2004,  p.  74) 

Investigators  need  to  be  familiar  with  the  technology  and  should  use  the  same 
case  management  system  they  use  every  day,  if  possible  (Murphy  &  Wexler,  2004,  p.  7). 

7.  Managing  Leads 

This  type  of  investigation  requires  a  robust  lead-management  system  along  with 
the  protocols  for  reviewing  investigative  work,  decision  making,  conducting  interviews 
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and  interrogations,  and  maintaining  quality  control  (Murphy  &  Wexler,  2004,  p.  60).  In 
addition,  agencies  should  plan  to  set-up  and  staff  a  tip  line  with  technology  capable  of 
answering  multiple  lines  (Murphy  &  Wexler,  2004,  p.  74).  The  Sniper  case  tip  line 
received  over  100,000  calls  and  generated  16,000  leads  for  follow  up  investigation 
(Murphy  &  Wexler,  2004,  p.  62). 

8.  Intelligence 

The  Maryland  State  Police  set-up  and  staffed  the  intelligence  component  at  the 
MCP  training  academy;  however,  because  of  communication  problems  arising  from  the 
separation  of  the  investigators  in  the  JOC  from  the  intelligence  officers  at  the  academy, 
the  intelligence  function  was  transferred  to  the  JOC  (Murphy  &  Wexler,  2004,  pp.  67- 
68).  The  intelligence  officers  felt  as  though  they  were  out  of  the  loop  when  stationed 
away  from  the  JOC  (Murphy  &  Wexler,  2004,  p.  69);  therefore,  the  intelligence  function 
should  be  collocated  with  the  operational  and  command  components  and  have  the 
necessary  technology  support  staff  to  sustain  this  function  (p.  75).  Moreover,  secure 
communications  for  the  sharing  of  law  enforcement  data  should  be  used  (Murphy  & 
Wexler,  2004,  p.  72). 

9.  Media 

Prior  to  an  incident,  craft  a  media  plan  that  identifies  duties  and  responsibilities, 
ways  to  manage  the  media  at  crime  scenes  and  press  conferences,  and  agencies’  points  of 
contact  for  the  media  (Murphy  &  Wexler,  2004,  p.  100).  As  with  the  law  enforcement 
executives,  the  public  infonnation  officers  should  attend  training  to  prepare  them  to  work 
in  those  environments  and  to  cultivate  relationships  with  their  counterparts  in  other 
jurisdictions  (Murphy  &  Wexler,  2004,  p.  101).  A  joint  information  center  (JIC)  should 
be  established  by  the  agencies  participating  in  the  investigation  (Murphy  &  Wexler, 
2004,  p.  101). 


10.  Prosecutors 

Because  coordination  and  communication  between  investigators  and  prosecutors 
is  imperative,  prosecutors  should  be  integrated  into  the  investigation  early  in  the  process 


42 


(Murphy  &  Wexler,  2004,  p.  58).  Similar  to  what  a  joint  information  center  (JIC)  does 
for  public  information  officers,  the  JOC  designated  a  room  where  federal  and  local 
prosecutors  could  coordinate  their  discussion  with  each  other  and  the  investigators 
(Murphy  &  Wexler,  2004,  p.  58).  Furthermore,  protocols  should  be  identified  for  how  the 
prosecution  function  can  integrate  with  the  investigative  function  to  ensure  that 
investigative  processes  are  used  that  will  facilitate  the  eventual  prosecution  of  the  cases 
(Murphy  &  Wexler,  2004,  p.  60). 

Preparation  for  this  type  of  case  will  have  a  large  impact  on  NCR’s  ability  to 
respond  to  similar  cases  in  the  future  (Murphy  &  Wexler,  2004,  p.  116).  Law 
enforcement  executives  should  meet  to  address  the  issues  outlined  in  the  PERF  report  and 
to  draft  a  blueprint  for  working  together  during  an  incident  similar  to  the  Sniper  case 
(Murphy  &  Wexler,  2004,  p.  116).  Law  enforcement  leaders  need  to  ask  themselves  the 
following  questions  during  that  preparation  phase  (Murphy  &  Wexler,  2004): 

•  “How  would  we  detennine  who  should  take  the  lead?”  (p.  1 16) 

•  “Where  would  the  task  force  be  headquartered?”  (p.  1 17) 

•  “What  is  the  media  plan?”  (p.  117) 

•  “How  can  we  keep  our  patrol  forces  well-briefed?”  (p.  1 17) 

•  “How  would  we  communicate  with  the  public,  victims,  and  suspects?”  (p. 
117) 

•  “Do  we  have  MOUs  with  other  agencies?”  (p.  117) 

•  “What  kind  of  information  management  system  do  we  have?  Others 

have?” (p.  117) 

•  “What  are  everyone’s  roles  and  responsibilities?”  (p.  1 17) 

•  “How  do  we  effectively  communicate  within  our  own  agency?  Other 

agencies?  The  Public?”  (p.  1 17) 

•  “How  do  we  evaluate  our  effectiveness?”  (p.  117) 

The  PERF  report  is  based  upon  the  experiences  of  an  intergovernmental  and 
interagency  law  enforcement  investigation  of  a  dynamic  and  serious  multijurisdictional 
crime  spree  (Murphy  &  Wexler,  2004).  This  chapter  has  highlighted  some  of  the 
principal  planning  and  operational  recommendations  made  in  the  report  based  upon  the 
lessons-leamed  from  the  DC  Sniper  case.  In  short,  the  report  states,  “Law  enforcement 
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needs  to  explore  how  to  better  manage  investigations  and  task  forces  involving  multiple 
agencies  and  levels  of  government...”  (Murphy  &  Wexler,  2004,  p.  31). 

The  PERF  report  (Murphy  &  Wexler,  2004)  recommends  the  use  of  a  standard 
incident  management  system  such  as  the  National  Incident  Management  System’s 
(NIMS)  Incident  Command  System  (ICS)  that  was  mandated  by  Homeland  Security 
Presidential  Directive  5  (HSPD-5)  for  most  jurisdictions  in  the  U.S.  (White  House, 
2003).  Multijurisdictional  investigations  should  use  NIMS,  but  there  are  useful 
components  from  another  incident  management  model  that  may  be  helpful  to  incorporate. 
The  next  chapter  will  focus  on  the  use  of  principles  from  the  U.S.’s  NIMS  and  the  United 
Kingdom’s  “Gold-Silver-Bronze”  incident  management  models  in  fashioning  an  NCR 
multijurisdictional  investigative  framework. 
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IV.  MANAGEMENT  OF  THE  INVESTIGATION 


Managing  tasks  and  resources  from  various  disciplines  and  levels  of  government 
during  a  regional  investigation  can  be  a  daunting  job  complicated  by  a  lack  of  command, 
control,  coordination,  and  communication,  especially  in  the  early  stages  of  the 
investigation  (DHS,  2008a,  pp.  3,  5-6).  A  model  for  incident  management  can  help  to 
manage  tasks  and  integrate  the  various  resources  to  provide  a  coordinated  and  effective 
investigative  response  (DHS,  2008a,  pp.  3,  5,  6).  This  chapter  will  explore  how  the  NCR 
can  improve  its  strategic  and  tactical  investigative  responses  by  utilizing  a  blend  of  the 
best  characteristics  of  the  incident  management  models  of  the  United  States  (U.S.)  and 
the  United  Kingdom  (UK).  In  the  U.S.,  that  management  model  is  known  as  the  National 
Incident  Management  System  (NIMS)  and  in  the  UK  that  management  model  is  known 
as  the  Gold-Silver-Bronze. 

A.  NATIONAL  INCIDENT  MANAGEMENT  SYSTEM  (NIMS) 

On  February  28,  2003,  President  George  W.  Bush  issued  Homeland  Security 
Presidential  Directive  5  (HSPD-5)  “To  enhance  the  ability  of  the  United  States  to 
manage  domestic  incidents  by  establishing  a  single,  comprehensive  national  incident 
management  system”  (White  House,  2003,  p.  1).  The  first  paragraph  of  HSPD-5  outlines 
the  policy  of  the  United  States  (White  House,  2003,  p.  1): 

To  prevent,  prepare  for,  respond  to,  and  recover  from  terrorist  attacks, 
major  disasters,  and  other  emergencies,  the  United  States  Government 
shall  establish  a  single,  comprehensive  approach  to  domestic  incident 
management.  The  objective  of  the  United  States  Government  is  to  ensure 
that  all  levels  of  government  across  the  Nation  have  the  capability  to  work 
efficiently  and  effectively  together,  using  a  national  approach  to  domestic 
incident  management. 

HSPD-5  mandates  the  adoption  of  the  NIMS  by  all  federal  departments  and 
agencies  as  well  as  entities  that  receive  federal  preparedness  assistance,  grants,  and 
contracts  (DHS,  2008a,  p.  4);  consequently,  all  states  and  most  local  jurisdictions  are 
required  to  adopt  the  NIMS  model  for  incident  management. 
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According  to  the  U.S.  Department  of  Homeland  Security’s  (DHS)  National 
Incident  Management  System,  one  of  the  five  main  components  of  NIMS  is  command 
and  management  (DHS,  2008a,  p.  45).  The  three  primary  elements  of  the  command  and 
management  component  are:  1)  the  incident  command  system;  2)  multiagency 
coordination  systems  (MACS);  and  3)  public  infonnation  (DHS,  2008a,  p.  45). 

1.  Incident  Command  System 

According  to  the  National  Incident  Management  System  (DHS,  2008a): 

ICS  is  a  widely  applicable  management  system  designed  to  enable 
effective,  efficient  incident  management  by  integrating  a  combination  of 
facilities,  equipment,  personnel,  procedures,  and  communications 
operating  within  a  common  organizational  structure.  ICS  is  a  fundamental 
form  of  management  established  in  a  standard  fonnat,  with  the  purpose  of 
enabling  incident  managers  to  identify  the  key  concerns  associated  with 
the  incident — often  under  urgent  conditions — without  sacrificing  attention 
to  any  component  of  the  command  system  (p.  45). 

ICS  is  used  to  organize  on-scene  operations  for  a  broad  spectrum  of 
emergencies  from  small  to  complex  incidents,  both  natural  and  manmade. 

The  field  response  level  is  where  emergency  management/response 
personnel,  under  the  command  of  an  appropriate  authority,  carry  out 
tactical  decisions  and  activities  in  direct  response  to  an  incident  or  threat. 
Resources  from  the  Federal,  State,  tribal,  or  local  levels,  when 
appropriately  deployed,  become  part  of  the  field  ICS  as  prescribed  by  the 
local  authority,  (p.  46) 

As  a  system,  ICS  is  extremely  useful;  not  only  does  it  provide  an 
organizational  structure  for  incident  management,  but  it  also  guides  the 
process  for  planning,  building,  and  adapting  that  structure.  Using  ICS  for 
every  incident  or  planned  event  helps  hone  and  maintain  skills  needed  for 
the  large-scale  incidents,  (p.  46) 

ICS  is  used  by  all  levels  of  government — Federal,  State,  tribal,  and  local — 
as  well  as  by  many  NGOs  and  the  private  sector.  ICS  is  also  applicable 
across  disciplines.  It  is  normally  structured  to  facilitate  activities  in  five 
major  functional  areas:  Command,  Operations,  Planning,  Logistics,  and 
Finance/Administration.  Intelligence/Investigations  is  an  optional  sixth 
functional  area  that  is  activated  on  a  case-by-case  basis,  (p.  46) 

ICS  was  created  in  the  1970s  by  the  Firescope  Program,  which  was  designed  by 
federal,  state,  and  local  firefighting  agencies  in  California  to  facilitate  integrated 
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operations  while  fighting  large-scale  forest  fires  (Buck,  Trainor,  &  Aguirre,  2006,  p.  1). 
ICS  is  a  management  tool  for  organizing  work  and  the  resources  to  accomplish  that  work, 
utilizing  principles  based  upon  traditional  management  theory:  (1)  standardized  job 
descriptions;  (2)  common  terminology;  (3)  chain  of  command;  (4)  unity  of  command;  (5) 
span  of  control;  (6)  scalable  &  modular  structure;  (7)  authority  commensurate  with 
responsibility;  and  (8)  management  by  objectives  (Buck  et  ah,  2006,  p.  1). 

During  the  1980s  and  1990s,  the  federal  government  incorporated  ICS  elements 
into  the  Federal  Response  Plan  (FRP)  and  the  Emergency  Response  Team  (ERT)  (Buck 
et  ah,  2006,  p.  2).  The  9/11  attacks  on  the  World  Trade  Center  and  the  Pentagon 
demonstrated  the  need  to  have  a  national  response  plan  for  the  management  of  disasters. 
ICS  was  used  at  the  Pentagon  to  organize  the  collaboration  and  response  of  multiple 
disciplines  (Titan,  2003,  pp.  11,  A21,  A28,  A48,  C13-16).  The  Pentagon  response  after 
action  report  concluded  that  the  Pentagon  response  was  well-organized  and  that  ICS  was 
a  substantial  contributor  to  that  success  (Titan,  2003,  p.  1 1).  The  911  Commission  Report 
agreed  with  this  assessment  when  it  acknowledged  that: 

The  emergency  response  at  the  Pentagon  represented  a  mix  of  local,  state, 
and  federal  jurisdictions  and  was  generally  effective.  It  overcame  the 
inherent  complications  of  a  response  across  jurisdictions  because  the 
Incident  Command  System,  a  formalized  management  structure  for 
emergency  response,  was  in  place  in  the  National  Capital  Region  on  9/1 1. 
(National  Commission  for  the  Terrorist  Attacks  upon  the  United  States. 

[9/1 1  Commission],  2004,  p.  314) 

Conversely,  the  response  to  the  WTC  attack  was  not  well-organized  for  days 
afterward  (Buck  et  ah,  2006,  p.  10;  9/11  Commission,  2004,  pp.  319-321).  One  of  the 
reasons  cited  for  the  unorganized  and  uncoordinated  response  was  the  lack  of  an  accepted 
management  response  model  (9/1 1  Commission,  2004,  pp.  319-321). 

Within  ICS,  command  authority  for  response  actions  resides  with  the  Incident 
Commander  or  Unified  Command  (DHS,  2008a,  pp.  49-50).  NIMS  recommends  that  a 
single  incident  commander  be  in  charge  in  those  incidents  that  involve  single  agencies 
within  a  single  jurisdiction  (DHS,  2008a,  pp.  49-50);  however,  for  incidents  that  span 
multiple  jurisdictions  or  involve  multiple  response  agencies,  representatives  from  those 
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agencies  and  jurisdictions  manage  the  incident  using  unified  command  (DHS,  2008a,  pp. 
49-50).  Unified  command  affords  the  opportunity  for  multiple  agencies  and  jurisdictions 
to  provide  input  into  an  integrated  management  organization  that  is  working  towards  the 
goal  of  achieving  common  objectives  within  the  oral  or  written  incident  action  plan 
(DHS,  2008a,  p.  49-50).  The  advantages  of  unified  command  for  a  multijurisdictional 
investigation  are: 

•  All  agencies  are  working  on  a  single  set  of  objectives; 

•  A  single  set  of  objectives  is  developed  for  the  entire  incident; 

•  A  collective  approach  is  used  to  develop  strategies  to  achieve  incident 
objectives; 

•  Infonnation  flow  and  coordination  are  improved  between  all  jurisdictions 
and  agencies  involved  in  the  incident; 

•  All  agencies  with  responsibility  for  the  incident  have  an  understanding  of 
joint  priorities  and  restrictions; 

•  No  agency’s  legal  authorities  will  be  compromised  or  neglected; 

•  The  combined  efforts  of  all  agencies  are  optimized  as  they  perform  their 
respective  assignments  under  a  single  IAP  [Incident  Action  Plan]  (DHS, 
2008a,  p.  50). 

The  ICS  model  provides  a  useful  structure  for  supporting  incident  command 
during  regional  investigations  (pp.  49-51).  The  other  four  primary  functional  divisions  of 
labor  in  ICS  are  the  Operations  Section,  Planning  Section,  the  Logistics  Section,  and  the 
Administration/Finance  Section  (pp.  54-59). 

a.  Operations  Section 

The  Operations  Section  manages  the  tactical  response  to  an  incident  or  an 
investigation  (DHS,  2008a,  p.  54).  When  many  resources  and/or  functions  are  involved  in 
the  tactical  response,  ICS  provides  additional  sub  groupings  such  as  branches,  groups, 
divisions,  task  forces,  and  strike  teams  (DHS,  2008a,  pp.  97-102).  These  structures 
ensure  that  key  management  principles  are  followed  when  organizing  resources. 
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b.  Planning  Function 

The  Planning  Section  collects,  evaluates,  and  disseminates  infonnation; 
maintains  the  status  of  resources  and  situational  awareness;  and  prepares  incident  action 
plans  and  maps  (DHS,  2008a,  p.  103). 

c.  Logistics  Function 

The  Logistics  Section  manages  the  logistical  requirements  of  all  agencies; 
establishes  and  furnishes  facilities  such  as  the  command  post;  and  secures  necessary 
equipment,  vehicles,  supplies,  and  personnel  (DHS,  2008a,  p.  107). 

d.  Financial  Management 

The  Finance/Administration  Section  establishes  procurement  procedures 
and  tracks  the  expenses  of  an  operation  (e.g.,  personnel,  equipment,  rentals,  travel, 
supplies,  workers  compensation).  (DHS,  2008a,  pp.  1 13-1 14). 
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When  investigations  become  less  dynamic  or  even  routine,  the  need  to 
have  the  planning,  logistics,  or  finance  sections  may  dissipate.  Because  ICS  is  a  modular 
system,  incident  command  should  mobilize  only  those  functions  necessary  to  manage  an 
incident  and  demobilize  them  when  no  longer  needed  (DHS,  2008a,  pp.  38,  47).  Figure  4 
depicts  an  ICS  chart  with  most  of  its  functional  structures. 

2.  Multiagency  Coordination  Systems  (MACS) 

After  ICS,  the  second  element  of  the  NIMS  Command  and  Management 
component  is  the  Multiagency  Coordination  System  (MACS),  which  is: 

...  a  system  that  provides  the  architecture  to  support  coordination  for 
incident  prioritization,  critical  resource  allocation,  communications 
systems  integration,  and  information  coordination.  MACS  assist  agencies 
and  organizations  responding  to  an  incident.  The  elements  of  MACS 
include  facilities,  equipment,  personnel,  procedures,  and  communications. 

Two  of  the  most  commonly  used  elements  are  Emergency  Operations 
Centers  and  MAC  Groups.  (DHS,  2008a,  p.  143) 

A  MAC  Group  is: 

...  a  group  of  administrators  or  executives,  or  their  appointed 
representatives,  who  are  typically  authorized  to  commit  agency  resources 
and  funds.  A  MAC  Group  can  provide  coordinated  decision-making  and 
resource  allocation  among  cooperating  agencies,  establish  the  priorities 
among  incidents,  hannonize  agency  policies,  and  provide  strategic 
guidance  and  direction  to  support  incident  management  activities.  (DHS, 

2008a,  p.  143) 

3.  Public  Information 

The  third  element  of  the  NIMS  command  and  management  component  is  public 
information.  This  element  specifies  a  joint  information  system  (JIS)  to  unify  the  public 
information  function  of  multiple  agencies  and/or  jurisdictions  in  a  joint  infonnation 
center  (JIC)  that  coordinates  public  infonnation  releases  (DHS,  2008a,  pp.  70-71). 

NIMS  online  training  modules  are  available  through  the  NIMS  Resource  Center 
while  dozens  of  NIMS/ICS  online  and  classroom  courses  are  advertised  on  the 
FEMA/Emergency  Management  Institute  (EMI)  website  (e.g.,  IS-700,  Introduction  to 
NIMS;  IS- 1 00,  Introduction  to  ICS;  IS-200,  ICS  for  Supervisors;  ICS-300,  Intennediate 
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ICS  for  Expanding  Incidents;  ICS-400,  Advanced  ICS  for  Command  and  General  Staff: 
Complex  Incidents. 

B.  THE  UK  GOLD-SILVER-BRONZE  MODEL 

As  a  result  of  large-scale  riots  in  1985,  the  UK  created  the  Gold-Silver-Bronze 
domestic  incident  management  model  for  handling  local  incidents  (Arbuthnot,  2008,  p. 
186).  The  concepts  of  this  model  are  explained  in  the  UK  documents: 

1.  Emergency  Response  and  Recovery  Plan  (HM  Government  of  the  UK, 

2010); 

2.  Responding  to  Emergencies:  The  UK  Central  Government  Response 
Concept  of  Operations  (Cabinet  Office,  2010);  and 

3.  the  Major  Incident  Procedure  Manual  (London  Emergency  Services 
Liaison  Panel,  2007). 

There  are  three  main  structural  levels  of  incident  management  within  the  UK 
model:  the  Bronze  level,  the  Silver  level,  and  the  Gold  level  (Cabinet  Office,  2010,  pp. 
49-50;  HM  Government,  2010,  pp.  63-74;  London  Emergency  Services  Liaison  Panel, 
2007,  p.  21). 
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Figure  5.  The  UK’s  Gold-Silver-Bronze  Model 


1.  Bronze  (Operational) 

The  Bronze  level  is  where  the  operational  work  is  perfonned  at  the  site  of  the 

emergency  (Cabinet  Office,  2010,  p.  49-50).  Each  response  agency  has  a  Bronze 

commander  who  manages  the  operational  tasks  associated  with  his/her  own  agency 

(Cabinet  Office,  2010,  p.  49-50),  but  who  does  not  have  control  over  resources  from 

other  agencies  (HM  Government,  2010,  p.  63).  Bronze  level  officers  are  expected  to 
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coordinate  with  their  counterparts  to  ensure  that  inter-agency  operations  run  as  smoothly 
as  possible  (Cabinet  Office,  2010,  p.  50).  Examples  of  Bronze  level  operations  for  law 
enforcement  agencies  would  be  to  establish  perimeters,  to  conduct  traffic  and  pedestrian 
control,  to  provide  security  to  the  response  areas,  and  to  conduct  investigations  (Cabinet 
Office,  2010,  p.  49-50).  Furthennore,  the  Bronze  level  is  roughly  equivalent  to  the 
Operations  Section  in  the  ICS  model. 

The  UK  model  uses  the  principle  of  subsidiarity  that  emphasizes  “decisions 
should  be  made  at  the  lowest  appropriate  level,  with  coordination  at  the  highest  necessary 
level”  (Cabinet  Office,  2010,  p.  5).  Only  when  emergency  operations  become  larger  is 
there  a  need  to  establish  the  higher  levels  of  Silver  and  Gold. 

2.  Silver  (Tactical) 

Silver  level  officials  are  typically  more  senior  officials  who  have  command  and 
coordination  authority  over  agency  resources,  and  they  ensure  that  the  actions  taken  by 
the  Bronze  level  are  coordinated  and  integrated  to  facilitate  maximum  effectiveness  and 
efficiency  (Cabinet  Office,  2010,  p.  50).  If  the  Silver  level  is  activated,  each  of  the 
primary  response  agencies  will  provide  a  Silver  level  officer  who  will  coordinate  with  the 
other  Silvers  to  ensure  an  integrated  operation  (Cabinet  Office,  2010,  p.  50).  The  Silver 
level  is  roughly  equivalent  to  the  Unified  Command  level  in  the  ICS  model. 

3.  Gold  (Strategic) 

According  to  the  UK’s  Emergency  Response  and  Recovery  Plan, 

The  purpose  of  the  Strategic  level  is  to  consider  the  emergency  in  its  wider 
context;  detennine  longer-tenn  and  wider  impacts  and  risks  with  strategic 
implications;  define  and  communicate  the  overarching  strategy  and 
objectives  for  the  emergency  response;  establish  the  framework,  policy 
and  parameters  for  lower  level  tiers;  and  monitor  the  context,  risks, 
impacts  and  progress  towards  defined  objectives.  (HM  Government,  2010, 
p.  69) 

Gold  level  personnel  are  not  command  personnel  for  the  incident,  but  rather  have 
a  coordinating  and  supporting  role  for  the  Silver  level  leadership  (HM  Government, 
2010,  p.  63).  They  are  the  senior  personnel  from  the  primary  agencies  providing  a 
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response  to  the  incident  who  have  the  authority  to  commit  the  agencies  resources 
(London  Emergency  Services  Liaison  Panel,  2007,  pp.  23-24).  A  police  or  fire  chief  or 
deputy  chief  would  be  an  example  of  a  Gold  level  official. 

The  Gold  level  personnel  will  form  a  strategic  coordinating  group  (SCG), 
which  is  widely  referred  to  as  the  “Gold  Group”  (Cabinet  Office,  2010,  p. 

7).  For  most  incidents,  Gold  Group  is  chaired  by  the  law  enforcement 
Gold  official  (Cabinet  Office,  2010,  p.  7);  however,  in  some  emergencies, 
such  as  a  health  emergency,  it  may  be  more  appropriate  to  have  a  health 
department  Gold  official  as  the  chair  of  the  SCG  (HM  Government,  2010, 
p.  73).  According  to  the  UK’s  Emergency  Response  and  Recovery  Plan, 

The  SCG  does  not  have  the  collective  authority  to  issue  commands  or 
executive  orders  to  individual  responder  agencies.  Each  organisation 
represented  retains  its  own  command  authority,  defined  responsibilities 
and  will  exercise  control  of  its  own  operations  in  the  normal  way.  (HM 
Government,  2010,  p.  72) 

Because  the  SCG  would  be  formed  for  incidents  spanning  multiple  operational 
periods,  a  sufficient  number  of  senior  leaders  need  to  be  trained  and  exercised  to  perform 
this  function  (HM  Government,  2010,  p.  72).  The  Multiagency  Coordination  Group 
(MAC  Group)  is  the  NIMS  equivalent  to  the  UK’s  Gold  level. 

C.  INCIDENT  COMMAND  FACILITY 

There  are  some  differences  in  how  the  U.S.  and  UK  incident  management  models 
handle  their  command  posts.  The  ICS  model  provides  for  a  single  command  post  (CP) 
where  the  Incident  Commander/Unified  Command  (UC)  manages  the  incident  (DHS, 
2008a,  pp.  49,  1 17).  The  Gold-Silver-Bronze  model  locates  its  incident  command  officers 
(Silver)  in  a  Joint  Emergency  Services  Control  Center  (JESCC)  where  each  response 
agency  locates  its  command  and  control  vehicle  into  a  cluster  of  vehicles  (London 
Emergency  Services  Liaison  Panel,  2007,  p.  19).  Furthennore,  the  police  Silver  has 
responsibility  for  establishing  a  liaison  with  all  the  command  vehicles  at  the  JESCC 
(London  Emergency  Services  Liaison  Panel,  2007,  p.  19)  and  for  ensuring  an  interagency 
phone  link  is  established  between  them  (p.  20).  The  NIMS  model  relies  on  co-location  of 
command  personnel  in  a  single  command  post;  whereas,  the  UK  model  relies  on  a 
network  of  collocated  command  posts  linked  by  technology. 
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1. 


Public  Information  Function 


The  U.S.  and  UK  models  have  a  similar  organizational  structure  for  handling 
pubic  infonnation.  In  both  models,  the  media  office  for  the  lead  department  or  agency 
will  be  the  primary  conduit  for  the  release  of  information  to  the  public  and  the 
coordination  of  media  activities  (HM  Government,  2010,  p.  181;  DHS,  2008a,  pp.  52, 
70).  Both  models  also  have  a  structure  for  the  integration  of  the  various  media  offices  of 
multiple  agencies,  jurisdictions,  or  levels  of  government  involved  in  larger  emergency 
responses.  The  ICS  model  calls  this  structure  the  joint  infonnation  system  (JIS),  a 
component  of  which  is  the  joint  infonnation  center  (JIC)  (DHS,  2008a,  pp.  70-71).  The 
JIC  can  be  an  actual  or  virtual  location  where  the  public  infonnation  officers  from 
involved  agencies  plan  and  integrated  their  activities  (DHS,  2008a,  p.  71).  The  UK  model 
uses  the  tenn  news  co-ordination  cell  (NCC)  for  this  function  (HM  Government,  2010,  p. 
181). 

There  are  similarities  and  differences  in  the  two  national  incident  management 
modules.  Both  systems  agree  on  the  need  for  at  least  three  basic  levels  of  organization  to 
manage  large-scale  incidents.  The  UK’s  model  calls  these  levels  Gold,  Silver,  and 
Bronze.  The  NIMS’  model  has  three  levels  with  responsibilities  congruent  with  the  UK’s 
model — the  MAC  Groups,  Unified  Command,  and  the  Operations  Section;  however, 
there  is  much  more  to  the  NIMS  model  than  these  three  structures.  Figures  4  and  5 
clearly  show  that  the  UK’s  Gold-Silver-Bronze  model  is  a  simple  grouping  of  functions 
into  three  basic  categories  whereas  the  U.S.’s  NIMS  model  can  grow  into  a  complex 
structure  for  managing  a  complex  incident  response.  Although  more  intricate,  the  NIMS 
model  seems  to  offer  more  functionality  from  an  organizational  and  planning  perspective 
than  the  Gold-Silver-Bronze  model;  however,  the  Gold-Silver-Bronze  model  offers  some 
insights  on  how  to  make  an  incident  management  model  simpler  to  understand,  and  how 
to  network  multiple  response  disciplines  using  available  technology. 

NIMS  and  the  Gold-Silver-Bronze  national  incident  management  models  are 
examples  of  structures  that  support  collaboration.  There  are  other  structural  or 
institutional  factors  that  promote  collaboration  such  as  training,  education,  and  policies; 

however,  structures  alone  are  not  sufficient  to  create  a  collaborative  environment.  The 
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next  chapter  will  examine  how  leadership,  technology,  and  institutional  factors  can  play  a 
leading  role  in  creating  a  team  environment  in  which  distinct  jurisdictions  and  disciplines 
can  work  together  effectively,  and  how  certain  behaviors  and  conditions  can  sabotage 
working  relationships. 


55 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


56 


V.  COLLABORATION 


According  to  Presidential  Policy  Directive  8  (PPD-8)  issued  in  March  2011,  “Our 
national  preparedness  is  the  shared  responsibility  of  all  levels  of  government,  the  private 
and  nonprofit  sectors,  and  individual  citizens”  (White  House,  2011,  p.  1).  PPD-8 
mandated  the  development  of  a  National  Preparedness  Goal,  which  was  subsequently 
developed  by  the  Secretary  of  the  Department  of  Homeland  Security  and  issued  in 
January  2012.  In  this  success  is  defined  as,  “A  secure  and  resilient  Nation  with  the 
capabilities  required  across  the  whole  community  to  prevent,  protect  against,  mitigate, 
respond  to,  and  recover  from  the  threats  and  hazards  that  pose  the  greatest  risk”  (DHS, 
2012,  p.  1).  The  National  Preparedness  Goal  identifies  35  core  capabilities  necessary  to 
support  the  five  homeland  security  missions  of  prevention,  protection,  mitigation, 
response,  and  recovery  (DHS,  2012,  p.  2).  Three  of  the  core  capabilities  crosscut  all  five 
missions:  planning,  public  information  and  warning,  and  operational  coordination  (DHS, 
2012,  pp.  2-3),  all  of  which  are  applicable  for  developing  a  framework  for 
multijurisdictional  and  interdisciplinary  regional  investigations.  Developing  and 
implementing  such  a  model  will  require  the  collaboration  of  leaders  and  operational 
personnel  within  several  disciplines,  and  this  chapter  discusses  those  leadership  and 
institutional  factors  that  either  foster  or  inhibit  collaboration. 

Building  a  collaborative  capacity  means: 

•  creating,  nurturing,  and  sustaining  inter-organizational  systems  to  achieve 
common  goals  that  will  yield  benefits  in  cost  savings  from  sharing  smart 
practices; 

•  making  decisions  that  incorporate  a  wide  range  of  input;  cooperating  with 
disperse  groups;  and  promoting  innovation  by  sharing  ideas  and  making 
due  with  limited  resources  (Hocevar,  Thomas,  &  Jansen,  2006,  p.  2). 

In  the  last  two  decades  of  the  twentieth  century,  organizations  were 
deemphasizing  their  hierarchal  structures,  empowering  employees,  and  organizing  their 
staff  into  internal  work  teams  (Linden,  2002,  p.  3).  The  first  decade  of  the  new  millennia 
saw  an  increase  in  networking  between  organizations  such  as  the  U.S.  Postal  Service 
partnering  with  FedEx  to  share  each  other’s  ground  and  air  assets;  the  three  levels  of 
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government  partnering  on  the  management  of  natural  resources;  and  the  CEOs  of  Ford, 
Chrysler,  and  GM  meeting  regularly  to  share  information  and  ideas  (Linden,  2002,  p.  3). 
Businesses,  various  levels  of  government  in  the  U.S.,  and  even  foreign  countries  have 
recognized  the  need  to  collaborate  and  have  established  structures  to  facilitate 
collaboration. 

In  2004,  Hocevar,  Jansen,  &  Thomas  published  their  research  findings  that 
identified  the  elements  that  either  foster  or  hinder  interagency  collaboration.  In  their 
study,  they  relied  upon  literature  and  experts  in  the  field  of  collaboration,  as  well  as  input 
from  30  senior  homeland  security  managers  who  participated  in  a  facilitated  workshop 
(Hocevar,  Jansen,  &  Thomas,  2004,  p.  ii.).  In  2006,  Hocevar,  Thomas,  &  Jansen 
published  a  follow  up  study  in  which  they  outlined  their  diagnostic  tool  to  measure  the 
collaborative  capacity  of  organizations.  They  used  Kurt  Lewin’s  “force  field”  analysis 
model  to  summarize  the  driving  and  restraining  forces  that  work  for  or  against 
interagency  change  (see  Table  1).  The  model  shows  how  driving  and  restraining  forces 
work  against  each  other  to  maintain  the  status  quo;  whereas,  if  interagency  collaboration 
is  to  improve,  the  driving  factors  must  become  stronger  and/or  the  restraining  factors 
must  weaken  (Hocevar,  Jansen,  &  Thomas,  2006,  p.  5). 
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Table  1.  Force-field  Analysis  for  Building  Collaborative  Capacity  (From  Flocevar, 

Thomas,  &  Jansen,  2006,  pp.  6-7) 


Force-field  Analysis  for  Building  Collaborative  Capacity 


Driving  Forces 

Restraining  Forces 

Organizational 
Design  Component 

“Success”  Factors  that  Foster 
Collaborative  Capacity 

“Barriers”  That  Inhibit 
Collaborative  Capacity 

Purpose  & 

Strateav 

(Driven  by  a  ‘felt 
need”  or  common 
goal) 

•  The  “felt  need”  to  collaborate. 

•  Common  goals  or  recognized 
interdependence. 

•  Adaptable  to  interests  of  other 
organizations. 

•  Divergent  goals. 

•  Focus  on  local  organization  rather 
than  regional  view. 

•  Lack  of  goal  clarity. 

•  Not  adaptable  to  interests  of  other 
organizations. 

Structure 
(Formal  power  & 
authority  of  those 
engaged  in 

interagency 
collaboration ,  p.  7) 

•  Formalized  coordination 
committee  or  liaison  roles. 

•  Sufficient  authority  of  participants 

•  Impeding  rules  or  policies. 

•  Inadequate  authority  of  participants. 

•  Inadequate  resources. 

•  Lack  of  accountability. 

•  Lack  of  formal  roles  or  procedures  for 
managing  collaboration. 

Lateral 

Mechanisms 
(Social  capital  and 
communication,  p.  7) 

•  Social  capital  (e.g.,  interpersonal 
networks). 

•  Effective  communication  and 
information  exchange. 

•  Technical  interoperability. 

•  Lack  of  familiarity  with  other 
organizations. 

•  Inadequate  communication  and 
information-sharing  (distrust). 

Incentives 

(The  payoffs  for 
collaboration,  p.  7)) 

•  Collaboration  as  a  prerequisite  for 
funding  or  resources. 

•  Leadership  support  and 
commitment. 

•  Absence  of  competitive  rivalries 

•  Acknowledged  benefits  of 
collaboration  (e.g.,  shared  resources). 

•  Competition  for  resources. 

•  Territoriality. 

•  Organization-level  distrust. 

•  Lack  of  mutual  respect. 

•  Apathy. 

People 

•  Appreciation  of  others’ 
perspectives. 

•  Competencies  for  collaboration. 

•  Trust. 

•  Commitment  and  motivation. 

•  Lack  of  competency. 

•  Arrogance,  hostility,  animosity. 
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Several  influential  environmental  factors  set  the  context  for  those  driving  and 
restraining  forces  (e.g.,  inclusion  of  all  the  right  stakeholders,  the  history  of  interagency 
relationships,  resource  competition  or  duplication,  laws  and  regulations,  and  the 
expectations  of  the  public)  (Hocevar  et  al.,  2004,  p.  32).  The  public’s  expectation  that 
agencies  and  jurisdictions  will  work  together  is  reflected  in  various  federal,  state,  and 
local  government  documents  discussed  in  previous  chapters  (e.g.,  Presidential  Policy 
Directive  8,  the  National  Preparedness  Goal,  the  National  Incident  Management  System, 
and  The  NCR  Homeland  Security  Strategic  Plan). 

A.  LEADERSHIP 

Robert  Agranoff  looked  at  the  challenges  facing  managers  in  working  with  groups 
and  agencies  outside  of  their  home  organizations  in  an  effort  to  detennine  how 
perfonnance  between  governmental  and  non-governmental  organizations  can  be 
improved  in  a  collaborative  environment  (2005,  p.  18).  He  found  eight  leadership 
behaviors  that  public  managers  should  employ  to  enhance  collaborative  perfonnance: 

1 .  send  the  proper  signals  to  their  managers  to  engage  in  collaborative  policy 
making  activities; 

2.  promote  networks  that  encourage  the  flow  of  information  between 
partners; 

3.  be  creative  and  proactive  in  identifying  opportunities  for  improvement; 

4.  promote  developing  collaborative  capacity  of  their  organizations; 

5.  make  strategic  public  investments  that  leverage  other  resources  to  get  the 
most  from  the  investment; 

6.  create  linkages  within  the  reservoir  of  human  capital; 

7.  assess  whether  there  is  an  added  value  created  by  the  collaboration; 

8.  obtain  feedback  from  the  customers,  assess  the  lessons-learned,  and  make 
the  required  improvements  (2005,  pp.  33-39). 

For  Agranoff,  performance  counts  since  there  must  be  some  public  valued 
gleaned  from  the  network  for  collaboration  to  be  worthwhile  (Agranoff,  2006,  p.  58).  He 
sees  some  potential  benefits  of  collaboration  as  1)  managers  and  professionals  learning 
new  ways  to  collaborate  and  enhance  technology  skills;  2)  agencies  accessing  new 
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information,  resources,  and  training;  and  3)  agencies  mastering  new  planning  capabilities, 
procuring  new  technology,  and  building  new  interagency  strategies  (Agranoff,  2006,  p. 
58). 

A  similar  view  of  leadership  is  espoused  by  Marcus  in  Meta-Leadership  and 
National  Emergency  Preparedness.  According  to  Marcus,  a  meta-leader  is  a  person  who 
can  transcend  the  problems  of  parochialism,  rivalries,  friction,  and  a  general  lack  of 
connectivity  between  government  agencies  (2006,  p.  42-44).  A  meta-leader  fosters  cross¬ 
agency  interaction,  communication,  confidence,  and  a  common  sense  of  purpose 
(Marcus,  2006,  p.  44).  He  or  she  has  personal  and  professional  credibility,  are  skilled  in 
the  art  of  negotiation,  and  seek  to  influence  the  actions  of  those  in  other  agencies 
(Marcus,  2006,  p.  45).  In  short,  meta-leaders  attempt  to  harness  all  the  horses  so  they  are 
pulling  the  cart  in  the  same,  and  right,  direction.  These  principles  are  consistent  with 
those  espoused  by  Paparone  in  Deconstructing  Army  Leadership  when  he  states  that 
leadership  is  about  influencing  collaborative  partners  for  mutual  goals  (2004,  p.  7). 
Another  meta-leader  trait  is  emotional  intelligence  (Marcus,  2006,  p.  52),  a  quality 
anchored  in  self-awareness,  an  inner  steadiness,  and  an  ability  to  empathize  and  relate 
well  to  others.  These  are  also  qualities  that  promote  leadership,  as  defined  by  Paparone 
who  sees  leadership  not  so  much  as  accomplishing  goals  but  as  fostering  common 
sentiments,  beliefs,  attitudes,  values,  and  commitment  (2004,  p.  4). 

According  to  Linden  in  his  article  “A  Framework  for  Collaborating,” 
collaborative  leaders  lead  as  peers,  listen  to  others,  and  recruit  people  into  partnerships 
(2002,  p.  6).  They  are  often  unassuming  people  whose  commitment  is  to  project  goals 
rather  than  their  own  egos  (Linden,  p.  6).  Linden  also  states,  “It  all  comes  down  to 
trust... if  parties  don’t  trust  one  another,  you’re  not  going  to  get  collaboration”  (p.  5). 
Collaborative  leaders  tend  to  see  the  big  picture  and  how  to  put  the  right  people  into  the 
right  jobs  (Linden,  2002,  p.  6). 


61 


B.  INSTITUTIONAL  FACTORS 

If  there  is  a  limited  history  of  engagement  between  agencies,  there  may  be 
inadequate  relationships  and  trust  bonding  between  parties  who  find  themselves  in 
environments  where  collaboration  is  essential  (Smith,  2007,  p.  18).  The  establishment  of 
rules  and  institutions  are  ways  that  governments  indicate  their  commitment  to  a  course  of 
action  and  provide  a  framework  for  public  managers  to  fonn  networks  of  partnerships 
that  can  achieve  the  goals  that  working  in  a  collaborative  manner  can  attain,  with  or 
without  a  pre-existing  basis  of  trust  (Smith,  2007,  p.  18). 

1.  Joint  Investigation  Teams  in  the  European  Union 

Due  to  the  sovereignty  of  the  European  Union  (EU)  and  the  fragmented  nature  of 
law  enforcement,  the  EU  has  had  some  historical  difficulty  conducting  transnational 
criminal  investigations  (Rijken  &  Venneulen,  2006,  p.  v).  To  resolve  this  problem,  the 
EU  created  the  structure  for  joint  investigations  teams  (JITs)  to  facilitate  investigators 
from  different  countries  banding  together  to  investigate  cross-border  crimes  (Rijken  & 
Venneulen,  2006,  p.  v).  An  academic  study,  supported  by  various  EU  governmental  law 
enforcement  agencies,  was  conducted  by  a  team  of  international  and  interdisciplinary 
researches  to  identify  those  dynamics  that  help  or  hinder  collaboration  within  the  JITs 
(Rijken  &  Venneulen,  2006,  pp.  v-vii).  The  study,  Joint  Information  Teams  in  the 
European  Union:  From  Theory  to  Practice,  provides  lessons-learned  and 
recommendations  based  upon  that  research  (Rijken  &  Venneulen,  2006). 

Mutual  trust,  the  felt  need  to  cooperate,  and  the  desire  to  share  information  are 
crucial  prerequisites  for  launching  a  JIT  (Rijken  &  Venneulen,  2006,  pp.  54,  58,  219— 
221,  224,  229).  There  are  three  keystones  for  the  founding  of  a  JIT:  1)  a  legal  basis  for 
the  JIT;  2)  the  selection  of  a  case  by  two  or  more  member  states;  and  3)  the  management 
of  the  JIT  (Rijken  &  Venneulen,  2006,  pp.  202-210).  The  EU  passed  joint  legislation  that 
laid  the  legal  groundwork  upon  which  JITs  can  be  formed  (Rijken  &  Venneulen,  2006, 
pp.  2,  201,  202).  Although  there  is  no  set  standard  for  the  management  of  the  JIT,  Rijken 
and  Venneulen  recommend  an  “inner”  and  “outer”  management  team  model  (2006,  pp. 
209-210).  This  paradigm  mirrors  the  NIMS  and  the  Gold-Silver-Bronze  models  in  which 
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the  “inner  JIT”  conducts  the  day-to-day  operations  in  a  facility  similar  to  a  U.S.  JOC 
(similar  to  ICS’  unified  command  /  UK’s  Silver  level),  while  the  “outer  JIT”  (senior 
representatives  of  the  participating  agencies)  functions  as  a  steering  committee  for  the 
investigation  (similar  to  ICS’  MAC  Group  /  UK’s  Gold  level)  (Rijken  &  Vermeulen, 
2006,  pp.  209-210). 

JITs  are  expensive  (like  JOCs),  and  their  structure  must  be  agreed  upon  prior  to 
their  establishment  (Rijken  &  Vermeulen,  2006,  p.  221).  Because  they  conduct  criminal 
investigations  in  a  novel  manner  and  because  they  are  not  used  frequently,  law 
enforcement  requires  training  for  JIT  management  and  operations.  The  willingness  to 
leam  from  each  other,  the  pairing  of  investigators  from  different  agencies,  and  team 
building  activities  were  considered  valuable  to  fonning  JITs  that  worked  well  together 
(Rijken  &  Vermeulen,  2006,  pp.  216,  217,  227). 

2.  Interagency  and  Multi-Discipline  Education 

Interagency  and  multidiscipline  education  in  the  military,  federal  government, 
homeland  security,  and  the  private  sector  has  been  beneficial  to  promoting  a  collaborative 
capacity.  The  federal  Goldwater-Nichols  Act  of  1996  (Goldwater-Nichols)  recognized 
that  the  cultural,  philosophical,  doctrinal,  and  organizational  differences  between  the 
military  branches  created  problems  for  their  working  together  (Smith,  2001,  p.  38).  To 
address  these  problems,  one  of  the  mandates  of  Goldwater-Nichols  was  to  establish  a 
program  of  joint  professional  military  education  (JPME)  and  temporary  joint  agency 
assignments  for  those  officers  aspiring  to  upper  level  management  positions  (Smith, 
2001,  pp.  23-24,  40-41;  Yeager,  2008,  p.  119).  This  professional  development  process 
has  produced  a  cadre  of  officers  with  solid  cross-agency  relationships  and  knowledge¬ 
base  that  promote  coordination,  cooperation,  and  an  atmosphere  of  trust  and  confidence 
(Smith, 200 l,pp.  39-41). 

In  2009,  the  Center  for  Homeland  Defense  and  Security  (CHDS)  at  the  Naval 
Postgraduate  School  (NPS)  published  the  report  Education:  The  Key  to  Homeland 
Security  Leadership.  This  document  addresses  why  the  CHDS  was  created,  who  CHDS 
would  educate,  and  what  necessary  educational  skills  CHDS  would  cultivate.  The  CHDS 
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was  created  in  2002  to  design  an  educational  program  to  fill  gaps  in  problem-solving  and 
interagency  coordination  and  cooperation  by  educating  professionals  in  homeland 
security  disciplines  to  better  fulfill  their  missions  of  prevention  of,  protection  against,  and 
response  to,  and  recovery  from  terrorist  attacks  (Center  for  Homeland  Defense  and 
Security  [CHDS),  2009),  p.  7-8,  11).  Through  education  and  research,  the  CHDS 
master’s  degree  program  has  spawned  a  core  of  homeland  security  professionals  (CHDS, 
2009,  p.  41)  who  use  critical  thinking  and  problem-solving  skills  to  work  in  a  complex 
and  abstract  environment  (CHDS,  2009,  pp.  8-9). 

Bellavita  and  Gordon,  CHDS  master’s  program  instructors,  provided  additional 
insight  into  the  program  in  their  2006  article  in  Homeland  Security  Affairs.  The  CHDS 
program  has  the  goal  of  expanding  the  participants’  homeland  security  context  and 
changing  how  they  think,  analyze,  and  communicate  about  homeland  security  issues 
(Bellavita  &  Gordon,  2006,  p.  5).  Moreover,  they  gain  perspectives  apart  from  their  own 
disciplines  in  which  they  recognize  that  all  the  various  disciplines  involved  in  homeland 
security  fit  into  a  mosaic  of  interagency  collaboration  in  which  each  piece  contributes  to 
the  whole  (Bellavita  &  Gordon,  2006,  p.  15).  The  CHDS  hoped  to  increase  its  students’ 
knowledge  base  in  12  core  areas,  one  of  which  addresses  the  leadership  challenges  of 
working  in  dynamic,  interagency,  multidisciplinary,  and  collaborative  environments 
(Bellavita  &  Gordon,  2006,  pp.  5-6).  Research  in  homeland  security  has  consistently 
demonstrated  that  “effective  collaboration  is  the  foundation  of  success”  (Bellavita  & 
Gordon,  2006,  p.  12),  and  that  collaborative  leadership  requires  cultivating  the  skills 
necessary  to  be  a  leader  in  networks  (p.  7),  where  command  and  control  is  a  less  effective 
leadership  style,  (p.  1 1). 

In  the  field  of  health  care,  the  United  Kingdom  recognized  that  collaboration  and 
teamwork  between  health  care  providers  was  necessary  to  successfully  integrate  services 
when  it  initiated  its  program  of  community  health  care  (Bligh  &  Parsell,  1998,  p.  526). 
To  be  successful,  health  care  practitioners  needed  to  be  adaptable,  flexible,  and 
collaborative  team  players  with  significant  interpersonal  skills  (Bligh  &  Parsell,  1998,  p. 
526).  One  of  the  ways  this  capability  was  formed  was  through  shared  learning  initiatives 
that  fostered  the  growth  of  an  interdisciplinary  base  of  knowledge,  teamwork,  and  a  big- 
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picture  understanding  of  the  roles  and  responsibilities  of  various  professions  involved  in 
the  initiative  (Bligh  &  Parsell,  1998,  p.  526).  This  process  produced  the  collateral 
benefits  of  changed  attitudes,  improved  relationships,  increased  trust,  and  reduced 
stereotyping  (Bligh  &  Parsell,  1998,  p.  526). 

3.  Exercises 

Presidential  Policy  Directive  8  provides  the  underlying  basis  for  using 
capabilities-based  planning  to  prepare  for  the  homeland  security  mission  of  prevention, 
protection,  mitigation,  response,  and  recovery  (White  House,  2011,  p.  1).  The  DHS 
Homeland  Security  Exercise  and  Evaluation  Program  (HSEEP)  is  a  capabilities  and 
perfonnance  based  exercise  program  that  furnishes  a  national  standard  for  the  design, 
development,  conduct,  evaluation,  and  improvement  planning  for  exercises  (DHS,  2007, 
p.  1).  HSEEP  does  not  tell  agencies  or  jurisdictions  what  to  exercise  but  rather  how  to 
exercise.  The  purpose  of  exercises  is  to  assess  preparedness  in  a  reduced-risk  setting  (p. 
1).  Exercises  can  help  evaluate  the  degree  to  which  capabilities  have  been  improved  by 
testing  and  validating  MOUs,  MAAs,  plans,  policies,  procedures,  training,  equipment, 
and  technology  (DHS,  2007,  p.  1).  Exercises  can  also  improve  collaboration,  refine  roles 
and  responsibilities,  and  identify  areas  for  improvement  (DHS,  2007,  p.  1).  HSEEP 
enumerates  the  elements  necessary  for  an  effective  Exercise  Program  Management  plan 
to  sustain  a  multifaceted  exercise  plan  over  an  extended  period  of  time — such  as 
planning,  project  management,  grants,  financial  management,  and  staffing  (DHS,  2007, 
p.  3).  The  dominant  feature  of  HSEEP  program  management  is  the  multi-year  exercise 
plan  (DHS,  2007,  p.  3).  The  exercise  plan  is  produced  as  a  result  of  a  Training  and 
Exercise  Workshop  in  which  stakeholders  identify  priority  capabilities  that  need  building 
(p.  3).  Stakeholders  then  plan  a  variety  of  exercises  (e.g.,  tabletop,  functional,  full-scale) 
to  assess  the  progress  of  improving  those  capabilities  over  several  years  (DHS,  2007,  p. 
3).  Therefore,  HSEEP  is  another  example  of  a  structure  that  supports  a  collaboration 
effort. 

The  current  trend  in  some  businesses  and  governments  to  work  within  a 
networked  and  collaborative  environment  is  a  good  example  for  those  who  may  be 
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involved  in  regional  LE  investigations.  When  multiple  law  enforcement  agencies  band 
together  in  joint  investigations,  they  do  not  fuse  into  one  unified  agency  but  rather 
maintain  their  distinctiveness  as  organizations.  Incorporating  other  disciplines  into  the 
investigation  (e.g.,  fire/EMS,  public  information,  and  fusion  centers)  creates  even  more 
complexity.  Research  and  experience  have  demonstrated  that  the  weaving  together  of  the 
right  leadership,  technology,  and  structural  support  can  build  the  collaborative  capacity 
and  operational  teamwork  necessary  for  intergovernmental,  interagency,  and 
multidisciplinary  groups  to  work  in  successful  partnerships. 

The  next  chapter  will  examine  what  subject  matter  experts  from  the  NCR’s  law 
enforcement,  fire/EMS,  public  infonnation,  and  fusion  center  disciplines  view  as 
principal  factors  in  facilitating  a  collaborative  effort  in  conducting  effective  and  efficient 
regional  investigations. 
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VI.  WHAT  DOES  THE  NCR  SAY? 


Previous  chapters  have  discussed  how  research  and  experience  have  expanded 
insights  into  how  to  conduct  a  successful  regional  investigation  by  1)  examining  lessons- 
leamed  from  the  DC  Sniper  case;  2)  incorporating  accepted  incident  management 
models;  and  3)  promoting  those  things  that  foster  collaboration  while  avoiding  those 
things  that  hinder  collaboration. 

A.  THE  DELPHI  SURVEY 

To  determine  how  NCR  regional  partners  would  answer  the  research  questions 
posited  in  Chapter  I,  19  subject  matter  experts  (SMEs)  from  the  NCR  disciplines  of  law 
enforcement,  fire/EMS,  public  information,  and  fusion  centers  were  interviewed  for  this 
research  using  the  Delphi  research  method.  Since  these  SMEs  are  from  agencies  that 
would  be  operating  within  the  framework  of  a  regional  investigative  framework,  it  is 
important  that  they  had  input  into  the  development  of  the  plan.  This  group  of  SMEs  will 
be  identified  in  the  remaining  chapters  as  the  Delphi  panel.  For  more  infonnation  about 
the  Delphi  survey  method  and  the  research  subjects  who  participated  in  the  interviews, 
see  Chapter  I. 

For  the  first  round  of  interviews,  the  Delphi  panel  members  were  interviewed  at 
their  place  of  employment  or  home  using  a  standard  questionnaire  that  had  been  emailed 
to  them  several  days  prior  to  the  interview  (see  the  appendix).  The  interviews  were  audio 
recorded  and  ranged  in  length  between  1-2.5  hours  each.  Afterwards,  typed  notes  of  the 
interviews  were  completed  based  upon  the  audio  recordings. 

For  analysis,  the  responses  from  the  first  round  of  interviews  were  listed  in  a 
Word  table,  with  very  similar  responses  grouped  into  a  single  response.  This  yielded  189 
responses  that  were  then  sorted  into  seven  primary  themes: 

•  Factors  that  foster  collaboration  (42  responses) 

•  Factors  that  hinder  collaboration  (26  responses) 

•  Incident  management  (24  responses) 

•  Joint  operations  centers  vs.  network-of-command-posts  (53  responses) 
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•  Training  and  exercises  (15  responses) 

•  Integrating  other  disciplines  into  regional  investigations  (24  responses) 

•  Law  enforcement  culture  (5  responses) 

In  the  table,  the  general  level  of  agreement  among  the  SMEs  was  noted  next  to 
each  response  by  listing  the  number  of  times  a  similar  comment  was  made  by  the  SMEs 
(e.g.,  one  SME,  some  SMEs,  many  SMEs,  most  SMEs,  and  all  SMEs).  Because  the 
SMEs  were  in  such  close  agreement  on  the  paramount  themes  of  the  research  after  the 
first  interview,  it  was  apparent  that  a  second  round  of  interviews  would  complete  the 
Delphi  process. 

In  preparation  for  the  second  round  of  interviews,  the  response  tables  were 
emailed  to  the  SMEs  with  the  request  to  review  each  of  the  189  comments  and  determine 
if  they  “agree,”  “disagree,”  or  were  “undecided,”  about  the  comment.  All  but  one  SME 
was  available  for  the  second  round  of  interviews  that  were  conducted  by  phone.  The 
SMEs  identified  those  responses  listed  in  the  table  for  which  they  either  disagreed  or 
were  undecided  about.  Since  the  SMEs  indicated  that  they  agreed  with  the  other 
remaining  responses,  the  other  responses  were  not  discussed  in  the  second  round  of 
interviews.  Since  most  of  the  SMEs  had  questions  about  the  context  of  some  of  the  other 
SMEs’  responses,  that  contextual  information  was  provided  to  them.  The  SMEs  advised 
that  that  helped  them  make  clearer  decisions  about  their  level  of  agreement  with  those 
responses. 

To  analyze  the  second  round  of  interviews,  the  SMEs’  decisions  (agree,  disagree, 
undecided)  about  each  of  the  189  responses  listed  in  the  Word  table  from  the  first  round 
of  interviews  were  computed.  To  detennine  the  level  of  consensus  for  each  response,  the 
results  were  tallied  to  identify  the  number  of  “agree,”  “disagree,”  or  “undecided” 
responses  for  each  of  the  189  statements  in  the  table. 

A  third  round  of  interviews  was  not  necessary  because  a  consensus  on  the  primary 
issues  had  been  achieved  by  the  end  of  the  first  round  of  interviews,  while  the  second 
round  provided  some  additional  insight  into  the  predominant  themes.  Of  the  189 
responses  from  the  first  round  of  interviews,  the  majority  of  SMEs  disagreed  with  only 

one  of  the  responses.  About  one  third  of  the  SMEs  were  in  disagreement  or  were 
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undecided  about  only  a  handful  of  other  responses,  while  the  vast  majority  of  SMEs 
agreed  with  all  the  other  responses  listed  in  the  Word  table.  Within  the  central  themes  of 
the  SMEs’  responses,  there  was  almost  unanimous  consensus  about  some  of  the  weightier 
issues. 

B.  FACTORS  THAT  FOSTER  COLLABORATION 

All  SMEs  identified  prior-established-relationships,  regular  communication,  and 
information-sharing  as  vital  to  a  collaborative  relationship.  In  addition,  MOUs  were 
recognized  as  important  for  some  working  relationships  to  clarify  roles,  responsibilities, 
expectations,  capabilities,  and  operational  issues,  among  other  things.  The  Delphi  panel 
was  in  strong  agreement  that  leaders  need  to  lead  by  example  and  stress  to  their  staff  to 
do  those  things  that  foster  a  collaborative  relationship  (e.g.,  being  transparent  in  their 
decisions,  emphasize  focusing  on  the  mission,  committing  the  appropriate  level  of 
resources,  sharing  information,  checking  egos  at  the  door,  and  designating  one  agency  as 
the  lead  agency  for  the  investigation). 

C.  FACTORS  THAT  HINDER  COLLABORATION 

The  SMEs  agreed  that  it  takes  work  to  collaborate  and  that  by  neglecting  to  do  the 
things  that  promote  collaboration,  the  level  of  teamwork  will  be  lessened.  They  identified 
factors  that  can  sour  interagency  relationships  as  not  sharing  information,  excessive 
personal  or  agency  egos,  a  lack  of  integrity,  and  backbiting.  They  identified  leadership 
behaviors  that  can  hann  relationships  as  leaders,  who  engage  in  political  posturing,  are 
media  or  glory-hounds,  do  not  respect  partners,  and  do  not  give  credit  to  assisting 
agencies.  A  lack  of  technology  to  nurture  communication  and  data-sharing  can  also 
negatively  influence  collaboration. 

D.  INCIDENT  MANAGEMENT 

Almost  all  of  the  SMEs  have  taken  Incident  Command  System  (ICS)  training; 
however,  most  local  law  enforcement  SMEs  do  not  use  it  frequently  in  their  duties.  The 
SMEs  recognized  the  need  for  a  system  to  manage  regional  investigation  and  made 
recommendations  for  how  unified  command  and  a  governing  body  should  be  established. 
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Almost  all  of  the  SMEs  were  unfamiliar  with  the  incident  management  system  in  the 
United  Kingdom  known  as  the  “Gold-Silver-Bronze.”  After  being  provided  an 
explanation  of  the  system,  the  law  enforcement  SMEs  were  in  agreement  that  the  Gold 
level  function  would  be  a  good  idea  to  incorporate  into  an  NCR  ICS-based  regional 
investigative  management  model.  The  Gold  level,  similar  to  the  NEVIS’  MAC  Group,  is  a 
cadre  of  senior  representatives  from  each  of  the  agencies  providing  essential  resources  to 
the  investigation  who  would  provide  oversight  and  governance  for  unified  command 
managing  the  investigation.  None  of  the  SMEs  volunteered  that  they  were  familiar  with 
the  ICS  concept  called  a  “MAC  Group.” 

The  law  enforcement  Delphi  panel  SMEs  were  in  agreement  on  the  appropriate 
level  of  rank  for  officers  serving  within  unified  command  and  the  MAC  Group  /  Gold 
level.  Unified  command  should  be  staffed  by  investigative  section  managers  (e.g.,  the 
Homicide  Commander,  the  Crimes-Against-Persons  Commander).  In  addition,  the  MAC 
Group  /  Gold  level  should  be  staffed  by  an  officer  just  below  the  level  of  police  chief 
(e.g.,  a  deputy  chief,  assistant  chief,  or  chief  of  detectives). 

None  of  the  law  enforcement  SMEs  thought  that  there  was  a  need  to  have 
common  investigative  protocols  for  local  law  enforcement  agencies  working  in  a  regional 
investigation  since  each  law  enforcement  agency  has  been  successful  in  using  its  own 
protocols.  Furthermore,  the  SMEs  recognized  that  it  would  be  impracticable,  and 
virtually  impossible,  for  the  large  number  of  NCR  jurisdictions  from  two  states  and  the 
District  of  Columbia  to  agree  upon  and  maintain  a  common  set  of  investigative  protocols. 

The  two  FBI  SMEs  clarified  the  roles  of  local  LE  and  the  FBI  during 

investigations  that  have  a  nexus  to  terrorism  and  those  that  do  not.  For  terrorism 

investigations,  the  FBI  is  the  lead  investigative  agency  while  local  LE  are  support 

agencies;  whereas,  in  non-terrorism  investigations,  local  LE  agencies  are  usually  the  lead 

agencies  and  the  FBI  may  be  a  support  agency.  When  the  FBI  is  the  lead  agency  for  a 

joint  investigation,  it  will  manage  the  investigation  via  its  Joint  Terrorism  Task  Force 

(JTTF)  structure.  Under  this  model,  local  LE  would  be  asked  to  augment  their  staffing 

compliment  to  the  JTTF  to  support  the  investigation.  At  a  terrorism  crime  scene,  the  FBI 

would  be  the  lead  agency  and  would  integrate  the  initial  investigative  response  within 
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unified  command  with  appropriate  local  response  agencies.  Because  terrorism  cases  will 
be  prosecuted  in  federal  courts,  the  investigation  will  follow  FBI  protocols,  especially  the 
paperwork.  For  those  investigations  where  local  LE  is  the  lead  investigative  agency,  the 
FBI  can  support  the  investigation  with  an  array  of  capabilities  and  would  operate  within 
the  management  structure  established  by  the  local  agencies. 

E.  JOINT  OPERATIONS  CENTER  (JOC)  VS.  A  NETWORK  OF 

COMMAND  POSTS 

For  regional  investigations,  there  was  great  consensus  among  LE  and  fusion 
center  SMEs  that  they  would  prefer  to  work  in  a  JOC  structure  rather  than  in  a  network  of 
command  posts.  They  thought  that  a  JOC  would  facilitate  communication,  information¬ 
sharing,  and  relationship-building  better  than  a  network  of  command  posts.  Furthermore, 
the  law  enforcement  SMEs  believed  that  a  JOC  was  appropriate  for  a  regional 
investigation  of  a  dynamic  and  high-impact  series  of  crimes  such  as  the  DC  Sniper  case. 
They  agreed  that  although  the  FBI  could  stand  up  a  JOC  quickly,  local  law  enforcement 
agencies  would  have  a  much  harder  time  standing  up  a  JOC  because  few  agencies  have  a 
location  suitable  for  a  JOC  or  the  finances  to  support  it.  Additionally,  there  may  not  be 
the  political  will  to  finance  a  JOC  unless  the  nature  of  the  crimes  compelled  the 
establishment  of  a  JOC. 

The  Delphi  panel  believed  that  the  type  and  scope  of  the  crimes  were  crucial 
considerations  when  deciding  between  a  JOC  or  network  of  command-posts  structure. 
They  recognized  that  a  network  of  command  posts  would  be  more  appropriate  for  a  series 
of  crimes  that  were  not  dynamic  or  having  a  high  public  impact.  Command,  coordination, 
communication,  and  data-sharing  would  be  significant  challenges  for  managing  an 
investigation  in  a  network  of  command  posts  rather  than  from  a  single  JOC;  therefore, 
effective  communication  and  data-sharing  technology  is  vital  to  the  success  of  a 
networked  investigation.  Most  of  the  SMEs  have  used  conference  calls,  but  few  had  the 
capability  for  video  teleconferencing  (VTC).  In  addition,  most  of  the  local  law 
enforcement  SMEs  were  unaware  of  the  FBI’s  Internet-based  case  management  system 
called  ORION  (Operational  Response  and  Investigative  Online  Network).  The  FBI  uses 
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this  system  for  managing  some  of  its  investigations  and  has  made  this  technology 
available  to  local  LE  through  LEO  (Law  Enforcement  Online). 

However,  two  NCR  local  law  enforcement  agencies  have  experience  using 
ORION  to  manage  cases.  One  jurisdiction  used  it  for  a  recent  regional  investigation  with 
federal  law  enforcement,  while  a  homicide  squad  in  another  jurisdiction  routinely  uses 
ORION  to  manage  certain  cases.  The  LE  SMEs  thought  it  would  be  worthwhile  for  NCR 
investigative  units  to  explore  using  the  ORION  technology.  Finally,  the  SMEs  recognized 
that  the  downside  of  a  network  investigation  would  be  that  it  would  be  more  difficult  to 
share  infonnation,  build  relationships,  and  manage  the  technology  training  and 
operational  issues. 

F.  TRAINING  AND  EXERCISES 

All  of  the  SMEs  thought  that  it  is  important  to  conduct  training  and  exercises  to 
build  interagency  and  multidisciplinary  collaborative  capacity.  Although  exercises  are 
another  demand  on  already  full  schedules,  the  SMEs  were  in  agreement  that  exercises  are 
part  of  the  job  and  that  personnel  need  to  make  the  time  to  participate  in  exercises  that 
can  help  identify  preparedness  gaps. 

G.  INTEGRATING  OTHER  DISCIPLINES  INTO  A  REGIONAL 

INVESTIGATION 

All  the  SMEs  recognized  the  importance  of  the  public  information  function  as  a 
significant  component  of  the  NIMS  model.  The  fire  department  SMEs  stated  that  fire 
departments  would  be  very  willing  to  assist  LE  in  a  manner  consistent  with  their  nonnal 
operations.  They  would  be  open  to  training  on  how  to  avoid  the  unnecessary  destruction 
of  evidence  at  crime  scenes,  and  to  being  extra  “eyes  and  ears”  to  collect  infonnation  in 
the  community  that  may  be  of  use  to  investigators.  Fire  department  personnel  have 
experience  in  managing  large  incidents  using  ICS  and  could  provide  incident 
management  expertise  to  law  enforcement  leaders.  Fusion  centers  SMEs  advised  that 
fusion  centers  can  support  regional  investigations  depending  on  the  seriousness  and 
multijurisdictional  nature  of  the  crimes.  Moreover,  fusion  centers  could  provide 
intelligence  support,  computer  background  checks  on  a  large  number  of  suspects, 
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information-sharing  infrastructure,  and  dissemination  of  information  to  a  large  number  of 
LE  agencies. 


H.  LAW  ENFORCEMENT  CULTURE 

Although  the  LE  discipline  is  fragmented  between  jurisdictions,  there  is  general 
agreement  among  the  LE  SMEs  that  NCR  LE  agencies  are  willing  to  work  with  each 
other,  despite  the  lack  of  respect  for  other  agencies  and  their  functions  that  sometimes 
exists.  Investigators  tend  to  have  strong  egos,  and  they  want  to  take  ownership  of  cases 
and  bring  them  to  successful  resolution.  This  is  normally  a  good  thing;  however, 
sometimes,  investigators  have  excessive  egos  and  want  to  be  the  “hero,”  which  can 
inhibit  collaboration  and  information- sharing.  Investigators  appreciate  technology,  but 
they  often  do  not  like  data  entry  tasks  such  as  entering  case  file  information  into  a  cases 
management  system.  When  using  technology,  they  want  to  understand  its  functionality 
and  how  it  can  be  a  benefit  to  them. 

The  input  from  the  19  Delphi  panel  members  represents  a  cross  section  of  ideas 
from  the  NCR  law  enforcement,  fire/EMS,  fusion  center,  and  public  infonnation 
disciplines.  There  was  a  remarkable  degree  of  consensus  between  agencies  and  across 
disciplines  for  how  to  build  a  collaborative  capacity  to  utilize  a  broad  range  of  NCR 
resources  to  conduct  regional  investigations.  The  Delphi  panel’s  viewpoints  on  how  best 
to  collaborate  were  very  much  in  line  with  the  academic  research  on  collaboration,  the 
findings  of  the  PERF  report,  and  the  incident  management  principles  espoused  by  NIMS 
and  the  Gold-Silver-Bronze  models.  This  chapter  has  identified  some  of  those  areas  of 
agreement  within  seven  primary  themes.  For  a  more  thorough  listing  of  the  ideas  in 
which  there  was  significant  agreement  among  the  Delphi  panelists,  see  the  Tables  2 
through  6. 
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Table  2.  Things  that  Foster  or  Hinder  Collaboration 


Delphi  Panel  Responses  -  Summary  Table 

Things  that  Foster  Collaboration 

Things  that  Hinder  Collaboration 

Relationships 

Not  Doing  the  Things  That  Foster 

•  Establishing  prior  relationships  which 
foster  trust,  the  sharing  of  information, 
and  good  working  relationships. 

•  Working  together  face-to-face. 

•  Identifying  roles,  responsibilities,  and 
expectations  of  each  agency  and  person. 

Collaboration 

•  Need  to  do  those  things  that  foster 
collaboration.  Doing  nothing  will  hinder 
collaboration. 

Egos,  Personalities,  Character 

•  Excessive  personal  egos. 

•  Cultural  agency  egos  that  make  its 
personnel  think  and  act  like  they  are  better 
than  others. 

•  Personality  conflicts. 

•  Lack  of  integrity,  sloppiness,  and 
dereliction  of  duty. 

•  Negative  words  or  actions,  unjust 
criticisms,  backbiting  other  agencies  and 
commanders. 

Memoranda  of  Understanding 

•  Can  help  define  roles  and  responsibilities, 
capabilities,  expectations,  points  of 
contact,  leadership,  logistics,  finances, 
and  operational  issues. 

•  Should  be  worded  in  cooperative  and 
collegial  terms,  and  let  the  leaders  work 
out  the  specifics  at  beginning  of 
investigation;  (several  SMEs  objected  to 
this  procedure,  stating  that  MOUs  should 
be  specific  to  say  something  and  mean 
something.) 

Communication 

•  Sharing  information  in  a  timely  manner 
within  and  between  agencies. 

•  Regular  briefings,  regularly  scheduled 
meetings  at  all  levels — managers, 
supervisors,  and  investigators. 

•  Explaining  why  actions  were  taken  or 
why  decisions  were  made. 

•  Controlling  rumors. 

•  Using  available  technology  to  maintain 
communication. 

Communication 

•  Personnel  who  withhold  information  from 
other  partners.  This  can  be  an  agency  or  an 
individual  characteristic. 

•  A  refusal  to  meet  with  partners  (e.g., 
investigators  who  refuse  to  meet  with 
prosecutors,  other  LE  partners). 

•  Poor  documentation  can  cause  loss  of 
information  in  a  case. 

•  Staff  turnover  can  cause  a  loss  of 
information  and  situational  awareness. 
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Delphi  Panel  Responses  -  Summary  Table 

Things  that  Foster  Collaboration 

Things  that  Hinder  Collaboration 

Leadership 

•  Leaders  need  to  lead  by  example  and  set 
the  tone  for  the  investigation,  e.g. 
“checking  egos  at  door,”  information¬ 
sharing,  emphasizing  teamwork,  and 
focusing  on  the  goals  of  the  investigation. 

•  Leaders  need  to  agree  on  common 
mission  and  goals. 

•  Managers  and  supervisors  need  to  stay 
engaged  at  their  appropriate  levels  of 
responsibility. 

•  Leaders  need  to  make  decisions  - 
otherwise  projects  will  die  on  the  vine. 

•  Leaders  need  to  foster,  train,  and 
encourage  those  things  that  promote 
collaboration,  and  discourage  those 
things  that  hinder  collaboration. 

•  Even  within  unified  command,  one 
agency  needs  to  take  the  lead. 

•  Leaders  who  have  a  track  record  of 
getting  things  done. 

•  Leaders  who  demonstrate  experience, 
competence,  and  commitment. 

•  Leaders  who  know  the  strengths, 
weaknesses,  and  capabilities  of 
themselves,  their  agencies,  and  other 
partner  agencies. 

•  Dedication  of  appropriate  level  of 
resources  to  the  mission. 

•  Consistent  conflict  management 
protocols. 

Leadership 

•  Leaders  who  insist  upon  doing  things  their 
own  way  when  all  other  leaders  want  to  go 
in  another  direction. 

•  Special  interests  that  prevent  leaders  from 
compromising. 

•  Paying  only  lip-service  to  collaboration. 

•  Political  posturing. 

•  Unqualified  leaders. 

•  Not  establishing  clear  roles  and 
responsibilities. 

•  Not  sharing  credit  with  other  partner 
agencies. 

•  Media  or  glory  hounds. 

Aeencv  Reputations 

•  Bad  agency  reputations,  deserved  or 
undeserved. 

•  Self-promoting  agencies  with  “media  or 
glory  hounds.” 

•  Lack  of  respect  and  trust  for  other  agencies 
and  their  personnel  to  do  their  jobs 
professionally. 

•  Some  agencies  have  inferiority  complexes 
to  other  agencies  or  disciplines — this  can 
cause  a  shut  down  or  lack  of  information¬ 
sharing. 

Trust 

•  Prior  relationships. 

•  Working  together  face-to-face  and  side- 
by-side. 

Misc. 

•  Systems  that  do  not  support  collaboration 
(e.g.,  an  interagency  investigation  that  does 
not  have  an  interoperable  data-sharing 
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Delphi  Panel  Responses  -  Summary  Table 

Things  that  Foster  Collaboration 

Things  that  Hinder  Collaboration 

Misc. 

•  It  takes  time  and  patience  for  groups  to 
work  well  together. 

•  Having  the  right  personnel  in  the  right 
position. 

•  Interdisciplinary  ride-along  programs. 

system). 

•  Media  leaks  can  cause  suspicion  among 
agencies  working  together. 
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Table  3.  NIMS  versus  Gold-Silver-Bronze 


Delphi  Panel  Responses -Summary Table 

Incident  Management  Model  Incident  Management  Model 

The  U.S.  NIMS  The  UK  Gold-Silver-Bronze 


•  18  of  the  19  SMEs  had  taken  ICS  training; 
however,  most  do  not  use  it  on  a  regular 
basis. 

•  ICS  is  a  “use  it  or  lose  it”  system.  Need  to 
maintain  competency. 

•  All  the  Fire  Department,  FBI,  &  PIO  SMEs 
rated  their  knowledge  of  ICS  as  high. 

•  Most  of  the  local  LE  agency  SMEs  rated 
their  knowledge  of  ICS  as  limited — 
although  most  said  they  had  a  working 
knowledge  of  some  ICS  principles. 

•  ICS  provides  a  template  or  structure  for 
collaboration,  leadership,  identifying  roles 
and  responsibilities,  and  the  organization  of 
resources. 

•  Only  one  local  LE  SME  (Virginia)  advises 
that  his  agency  uses  ICS  routinely  and  has  a 
high  level  of  competency. 

•  The  two  FBI  SMEs  describe  themselves  as 
well-versed  in  ICS. 

•  All  local  LE  SMEs  think  that  in  a  joint 
investigation  with  unified  command,  the 
investigative  section  commanders  would  be 
the  appropriate  level  for  unified  incident 
commanders. 

•  The  FBI  does  not  use  ICS  in  its  Joint 
Operations  Center  or  investigative  model; 
however,  the  FBI  will  integrate  into  unified 
command  when  working  as  a  support 
agency  with  local  LE. 

•  Specialize  units  within  the  FBI  WFO  have 
been  trained  in  ICS  and  use  it  operationally, 
e.g.  HazMat,  bomb  techs,  and  others. 

•  Most  FBI  investigators  are  not  familiar 
with  ICS. 

•  By  its  very  placement  within  the  Command 
Staff  of  ICS,  ICS  recognizes  the 


•  Several  SMEs  had  a  modest  familiarity 
with  the  UK’s  Gold-Silver-Bronze 
incident  management  model;  whereas,  the 
others  had  no  familiarity  with  the  model. 

After  a  basic  explanation  of  the  model,  with 
an  emphasis  on  the  Gold  Level,  the  SMEs 
were  asked  their  opinion  of  the  efficacy  of 
using  the  Gold  Level  in  a 
multijurisdictional  investigation. 

•  The  Gold  Level  naturally  occurs  in  many 
major  investigations — upper  level 
management  usually  gets  involved  (e.g., 
the  DC  Sniper  investigation). 

•  The  Gold  Level  would  serve  an  important 
function  in  a  multijurisdictional 
investigation. 

•  Building  the  Gold  Level  into  the 
management  model  would  be  a  good  thing 
because  it  prompts  agencies  to  put 
someone  in  charge  of  fulfilling  that  role. 

•  Non-LE  leaders  should  be  included  in  the 
Gold  Level  if  they  provide  significant 
resources  to  support  the  investigation. 

•  All  local  LE  SMEs  thought  that  for  serious 
multijurisdictional  investigations,  the 
appropriate  level  for  Gold  would  be  the 
rank  just  below  the  Chief  of  Police  (e.g. 
Deputy  Chief,  Chief  of  Detectives). 

•  Gold  Level  can  set  the  tone  for  agency 
participation  in  joint  investigations. 

•  Gold  Level  needs  to  understand  its 
function  and  responsibilities,  e.g., 
providing  oversight  without  getting 
involved  in  the  day-to-day  decision¬ 
making. 

•  Several  SMEs  thought  that  the  Gold  Level 
serves  the  same  function  at  the  Principle 
Federal  Officer  (PFO)  in  the  federal 
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Delphi  Panel  Responses  -  Summary  Table 

Incident  Management  Model 

The  U.S.  NIMS 

Incident  Management  Model 

The  UK  Gold-Silver-Bronze 

importance  of  the  public  information 
function. 

•  ICS  is  not  a  substitute  for  leadership. 
Leadership  +  ICS  is  a  recipe  for  success. 

•  One  local  Fire  Department  has  a  yearly 
command  competency  test  for  its  chief 
officers  to  ensure  they  can  demonstrate  and 
retain  their  ability  to  use  ICS  in  a  practical 
setting. 

•  None  of  the  SME’s  proactively  expressed 
knowledge  of  MAC  Groups  that  serve  the 
same  function  as  the  UK’s  Gold  level. 

system. 

•  Gold  Level  needs  its  own  level  of  the  PIO 
function  because  of  the  political  nature  of 
that  level. 

Table  4.  JOC  versus  Network  of  Command  Posts 


Delphi  Panel  Responses  -  Summary  Table 

Joint  Operations  Center  (JOC) 

Network  of  Command  Posts 

JOC:  A  joint  operations  center  is  a 
facility  that  functions  as  the  command 
post  for  a  joint  investigation. 

Network:  When  multiple  investigative 

agencies  work  a  joint  investigation  from  their 
own  individual  agency  command  post. 

•  The  preference  is  to  work  in  a  JOC 
rather  than  a  network  of  command  posts. 

•  SMEs  recognize  that  a  network  may  be 
more  practical  for  some  investigations. 

When  to  Stand  Un  a  JOC? 

•  A  JOC  is  more  appropriate  for  a 
dynamic  and  high-impact  investigation 
(e.g.,  the  DC  Sniper  investigation). 

•  The  type  and  scope  of  the  crimes  are  a 
key  consideration  for  standing  up  a  JOC. 

When  to  Use  a  Network? 

•  For  joint  investigations  of  crimes  that  are 
not  as  dynamic  and  do  not  have  a  high 
public  impact,  e.g.,  serial  rapes  that  occur 
infrequently,  serial  burglaries. 

•  The  type  and  scope  of  the  crimes  are  a  key 
consideration. 
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Delphi  Panel  Responses  -  Summary  Table 

Joint  Operations  Center  (JOC) 

Network  of  Command  Posts 

The  JOC  is  a  better  venue  for 

•  Establishing  relationships,  trust  and 
bonding. 

•  Sharing  information. 

•  Generating  ideas  from  a  cadre  of 
professionals  working  together. 

•  Resolving  problems. 

•  Communicating. 

Technologv 

•  The  technology  is  not  available  to  make  a 
network  investigation  work. 

•  The  right  communication  and  information¬ 
sharing  technology  must  be  present. 

•  Need  to  use  technology  to  bring  together 
geographically  dispersed  jurisdictions. 

•  A  central  case  fde  repository  is  necessary. 

•  Most  SMEs  are  familiar  with  conference  call 
communication  technology. 

•  The  investigative  model  should  include 
guidelines  on  the  use  of  technology  to 
ensure  that  proper  communication  and 
information-sharing  occurs. 

•  Data  entry  into  a  central  electronic  case  file 
will  be  a  significant  issue. 

Standing  Up  a  JOC 

•  The  FBI  has  several  pre-identified  NCR 
locations  for  JOCs  that  can  be  set  up 
within  12  hours. 

•  When  necessary  for  a  local  LE 
investigation,  the  NCR  police  chiefs 
need  to  take  the  initiative  to  set  it  up  and 
staff  it. 

•  Local  NCR  LE  should  have  a  location 
pre-established  for  a  JOC.  Two  NCR 
jurisdictions  have  a  facility  that  could  be 
converted  into  a  JOC,  if  needed. 

•  If  local  LE  were  to  set  up  a  JOC,  there 
would  be  issues  about  who  would  pay 
for  it. 

Communication 

•  There  should  be  regularly  scheduled 
conference  calls  for  information  and  data- 
sharing. 

•  The  three  main  things  necessary  for 
communication  to  work  in  a  network: 

1)  Everyone  should  have  the  same 
technology;  2)  Common  protocols  for 
information-sharing;  3)  Need  to  practice 
and  exercise  on  the  technology  so  users 
know  how  to  use  it  when  needed. 

Misc. 

•  Prior  relationships  help  a  JOC  function 
more  smoothly. 

•  A  central  location  for  tip  management  is 
necessary. 

•  It  helps  to  have  a  direct  conduit  to  cases 
and  evidence  from  other  agencies. 

•  It  helps  assemble  the  strengths  and 
capabilities  of  involved  agencies. 
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Joint  Operations  Center  (JOC) 

Network  of  Command  Posts 

Disadvantages  of  a  JOC 

•  They  cost  a  lot  of  money  to  set  up.  There 
may  not  be  the  political  will  to  so  this. 

•  Most  jurisdictions  are  not  prepared  to 
stand  up  a  JOC. 

•  If  some  agencies  do  not  participate  in 
the  JOC,  then  there  could  be  a  splitting 
of  the  investigation. 

•  Geography  could  cause  problems  for 
jurisdictions  that  are  geographically 
removed  from  the  JOC  location.  (Some 
SMEs  voiced  that  if  there  is  a  JOC 
established,  then  remote  agencies  need 
to  ensure  that  their  personnel  staff  the 
facility.) 

Efficiency 

•  Staff  does  not  waste  time  in  commuting  to  a 
remote  JOC  location. 

•  Investigators  can  use  their  normal  work 
stations,  technology,  support  personnel,  etc. 

Misc. 

•  A  history  of  working  well  together  can  make 
a  network  function  well. 

•  When  working  in  a  network,  there  is  still  the 
need  for  one  agency  to  be  the  lead  agency  in 
the  investigation. 

•  A  virtual  joint  information  center  (JIC) 
would  be  the  appropriate  structure  for  the 
public  information  function. 

ORION:  Internet-based  Case  Management 

System 

•  FBI  uses  ORION  as  their  case  management 
system.  The  same  system  is  available  for 
use  by  local  LE  via  Law  Enforcement 

Online  (LEO). 

•  Most  local  LE  agencies  are  unfamiliar  with 
this  system. 

•  Prince  George  County’s  Homicide  Squad 
regularly  uses  ORION  to  manage  some 
cases. 

•  Prince  William  County  PD  has  used 

ORION  for  a  recent  regional  investigation. 

•  A  network  investigation  is  now  possible 
that  was  not  possible  five  years  ago. 

•  An  advantage  of  an  Internet-based  case 
management  system  is  that  remote  viewing 
and  data  entry  can  be  made  for  intelligence, 
leads,  information,  etc. 
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Joint  Operations  Center  (JOC) 

Network  of  Command  Posts 

Disadvantages  of  a  Network 

•  If  an  incident  disrupts  infrastructure,  Internet 
access  for  ORION  may  be  lost. 

•  Only  a  few  law  enforcement  agencies  have 
access  to  video-teleconferencing  technology 
for  virtual  meetings. 

•  Can  be  harder  to  establish  relationships  and 
trust  in  a  network,  especially  with  out  of 
state  agencies  that  are  not  past  partners. 

•  Some  information  will  be  lost  in  a 
networked  investigation. 

Table  5.  Training  and  Exercises 

Delphi  Panel  Responses  -  Summary  Table 
Training  and  Exercises 

Exercises:  Benefits  to  Collaboration 

•  Builds  relationships. 

•  Fosters  communication. 

•  Dispels  unrealistic  expectations  of  capabilities  of  partner  agencies. 

•  Merely  inviting  other  agencies  to  training  events  establishes  interagency  good  will. 

Simulating  Reality 

•  Tabletop,  functional,  and  full-scale  exercises — there  are  a  variety  of  exercises  that  can  be 
staged  for  various  types  of  personnel. 

•  Exercises  should  be  interagency  and  multidisciplinary  to  simulate  reality.  Agencies 
typically  already  know  how  to  do  perform  their  function;  however,  the  challenge  is  to 
integrate  the  responses  of  all  partners. 

•  Can  help  to  identify  preparedness  gaps. 

Mise. 

•  Most  SMEs  have  participated  in  exercises  (e.g.,  tabletop,  functional,  full-scale). 

•  Police  chiefs  need  to  ensure  that  their  personnel  participate  in  exercises. 

•  Informational  interdisciplinary  training  bulletins  would  be  helpful  for  agencies  to  gain  an 
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Delphi  Panel  Responses  -  Summary  Table 


Training  and  Exercises 

understanding  of  other  disciplines. 

•  Using  a  system  like  ORION  will  require  training  of  all  users,  and  supervisors,  and  some 
managers. 


Table  6.  Law  Enforcement  Culture 


Delphi  Panel  Responses  -  Summary  Table 


Law  Enforcement  Culture 


•  Although  the  LE  discipline  is  very  fragmented  between  jurisdictions  and  levels  of 
government,  there  is  a  general  sense  that  LE  in  the  NCR  are  willing  to  work  together 
closely  on  regional  investigations. 

•  Sometimes  there  is  a  lack  of  respect  for  other  agencies  and  their  functions  (e.g.,  rifts 
between  federal  and  local  LE,  or  between  patrol  and  investigators). 

•  Investigators  tend  to  have  strong  egos  which  inspire  them  to  take  ownership  of  cases  and 
bring  them  to  successful  conclusions. 

•  Sometimes,  investigators  have  excessive  egos  and  want  to  be  the  “hero.”  Excessive  egos 
can  inhibit  collaboration  and  information-sharing. 

•  Technology:  Oftentimes,  investigators  do  not  like  data  entry  tasks,  such  as  entering  case 
file  information  into  a  case  management  system. 

•  Technology:  When  using  technology,  LE  officers  want  to  understand  its  functionality  and 
how  it  can  be  a  benefit  to  them. 


Table  7.  Integrating  Other  Disciplines  into  a  Regional  Investigation 

Delphi  Panel  Responses  -  Summary  Table 
Integrating  Other  Disciplines  Into  a  Regional  Investigation 

Public  Information  Function 

•  This  function  is  recognized  as  important  and  integral  to  law  enforcement  investigations,  and 
that  it  is  part  of  the  ICS  model. 

•  Common  messaging  is  important. 

•  Most  SMEs  were  unaware  of  the  function  of  the  Joint  Information  Center  within  ICS. 

•  The  NCR  has  a  very  active  Regional  Emergency  Support  Function  #15,  Public  Information. 
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Integrating  Other  Disciplines  Into  a  Regional  Investigation 

Fire  Departments 

•  The  fire/EMS  discipline  wants  to  support  LE  in  regional  investigations. 

•  FDs  are  willing  to  act  as  eye  and  ears  for  intelligence  purposes. 

•  FDs  have  experience  in  managing  large-scale  incidents  and  can  provide  that  expertise  to 
LE. 

•  FDs  have  gear,  tools,  and  resources  that  other  agencies  do  not  have. 

Fusion  Centers 

•  Three  fusion  centers  serve  the  NCR  and  have  a  good  working  relationship  with  each  other. 

•  Can  assist  in  regional  investigations  depending  on  the  type  and  scope  of  the  crime  problem 
(e.g.,  serious  crimes  that  span  multiple  jurisdictions). 

•  Can  provide  information-sharing  infrastructure  for  investigators  (e.g.,  license  plate  reader 
program  in  Maryland,  D.C.,  and  Virginia). 

•  Can  develop  leads  for  investigators  and  support  intelligence  functions. 

•  Have  many  contacts  that  may  be  able  to  assist  in  LE  investigations. 

•  Can  run  computer  background  checks  for  investigations  that  have  many  possible  suspects. 

•  Can  quickly  disseminate  information  to  other  LE  agencies. 

•  Can  condense  a  large  amount  of  information  into  executive  summaries. 
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VII.  CONCLUSIONS 


Previous  chapters  provided  data  concerning  the  current  state  of  affairs  in  the 
NCR,  lessons-leamed  from  the  DC  Sniper  case,  management  techniques  provided  by  the 
incident  management  models,  academic  research  on  collaboration,  and  the  viewpoints  of 
the  Delphi  panel.  Since  each  piece  of  data  in  this  paper  is  like  a  piece  in  a  mosaic,  this 
chapter  will  attempt  to  synthesize  all  the  data  into  a  congruent  whole  that  creates  an 
accurate  picture  of  the  NCR’s  preparedness  to  conduct  an  integrated  intergovernmental, 
interagency,  and  multidisciplinary  investigative  response  to  a  critical  series  of  crimes 
spanning  multiple  NCR  jurisdictions. 

The  NCR  local  law  enforcement  agencies  currently  do  not  have  a  framework  for 
managing  the  investigation  of  a  pattern  of  serious  crimes  spanning  multiple  NCR 
jurisdictions.  Like  other  large  metropolitan  areas,  the  NCR  has  experienced  felony 
pattern  crimes,  as  well  as  the  DC  Sniper  attacks  in  2002,  and  is  a  prime  target  for 
terrorism  attacks.  Yet,  local  law  enforcement  agencies  are  fragmented  by  18 
jurisdictional  boundaries,  while  federal  law  enforcement  is  divided  by  field  offices  that 
split  responsibilities  within  the  NCR.  Other  disciplines  such  as  the  fire/EMS,  fusion 
centers,  and  public  information  are  also  fragmented  by  local  jurisdictional  boundaries. 

A.  COLLABORATIVE  CAPACITY 

Despite  the  inherently  fragmented  nature  of  the  NCR’s  multijurisdictional 
landscape,  the  NCR  has  the  collaborative  capacity  necessary  to  craft  a  local  law 
enforcement  model  to  manage  a  regional  investigation.  The  Metropolitan  Washington 
Council  of  Governments,  the  NCR,  and  the  Department  of  Homeland  Security  support 
regional  planning,  committees,  and  other  structures  that  foster  regional  collaboration  and 
preparedness  activities.  The  National  Preparedness  Goal,  the  National  Response 
Framework,  the  National  Incident  Management  System  (NIMS),  the  Homeland  Security 
Exercise  and  Evaluation  Program  all  support  collaboration  to  build  capabilities  necessary 
for  homeland  security  missions. 


85 


The  NCR  Homeland  Security  Strategic  Plan  2010  has  priority  goals  that  promote 
planning,  interoperable  communication,  and  data-sharing.  The  PERF  report  on  the  DC 
Sniper  case  also  makes  recommendations  consistent  with  the  themes  of  preplanning, 
collaborative  decision  making,  interoperable  communication,  and  infonnation-sharing 
(Murphy  &  Wexler,  2004).  Jointly,  all  of  these  documents  encourage  the  enhancement  of 
planning,  incident  management,  interoperable  communication,  and  data-sharing 
capabilities  which  are  necessary  for  creating  an  investigative  framework  to  manage  a 
regional  investigation.  The  groundwork  certainly  exists  to  facilitate  the  NCR’s  18 
independent  jurisdictions  functioning  as  one  team. 

B.  THINGS  THAT  FOSTER  OR  HINDER  COLLABORATION 

The  factors  that  foster  collaboration  can  be  grouped  into  three  basic  categories:  1) 
leadership;  2)  technology;  and  3)  institutional  or  structural  features.  The  PERF  report,  the 
Delphi  panel,  and  the  academic  research  on  collaboration  are  consistent  in  identifying 
those  factors  that  promote  or  hinder  collaboration.  There  is  a  need  to  establish 
intergovernmental  and  interagency  relationships  prior  to  an  incident  that  can  help  fonn 
the  basis  for  trust,  respect,  social  capital,  consensus-building,  and  an  appreciation  for  the 
capabilities  of  other  agencies.  Technology  must  be  available  to  all  partners  to  support 
interoperable  communication  and  data-sharing.  In  addition,  the  institutional  structures,  as 
seen  prominently  in  the  NCR,  must  be  there  to  support  a  collaborative  effort.  Policies, 
procedures,  models,  MOUs,  strategic  plans,  education,  training,  exercises,  and  funding, 
all  contribute  to  the  institutional  and  structural  commitment  necessary  for  agencies  to 
work  together.  Collaboration  does  not  just  happen — it  requires  leaders  and  personnel  at 
all  levels  to  do  the  things  necessary  to  make  collaboration  happen.  Not  doing  those 
necessary  things  can  hinder  collaboration.  Some  of  the  principal  factors  that  hamper 
collaboration  are  a  lack  of  communication,  the  withholding  of  information,  excessive 
egos,  and  the  lack  of  systems  that  support  collaboration. 

Creating  MOUs  prior  to  incidents  can  help  define  relationships,  roles, 
responsibilities,  and  how  agencies  will  work  together;  however,  there  was  some 
disagreement  among  the  Delphi  panel  members  about  whether  an  investigative  MOU 
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should  list  the  specifics  of  the  working  relationships  or  be  more  flexible  to  allow 
leadership  to  work  out  the  details  at  the  beginning  of  a  joint  investigation.  While  a  formal 
investigative  MOU  may  be  difficult  to  negotiate  and  maintain  between  the  18  NCR 
jurisdictions  and  the  federal  law  enforcement  agencies,  the  COG’s  Police  Chiefs 
Committee  (R-ESF  #13)  could  adopt  an  investigative  framework  for  the  joint 
investigation  of  regional  pattern  crimes.  The  unified  support  for  this  model  from  the 
Police  Chiefs  Committee  would  provide  a  strong  basis  for  collaboration,  while  giving 
local  and  federal  law  enforcement  agencies  some  flexibility  working  within  its 
guidelines. 

C.  INCIDENT  MANAGEMENT 

1.  FBI  versus  Local  Law  Enforcement  as  the  Lead 

The  National  Response  Framework  designates  the  FBI  as  the  lead  agency  for 
terrorism  investigations,  while  other  federal  laws  give  the  FBI  primary  jurisdiction  over 
other  types  of  crimes,  some  of  which  have  an  interstate  nexus  (U.S.  Government,  2013). 
There  is  a  difference  between  joint  investigations  in  which  the  FBI  is  the  lead  agency  and 
when  the  FBI  is  a  support  agency.  When  the  FBI  is  the  lead  agency,  there  is  little  need  for 
local  law  enforcement  to  have  an  investigative  framework  in  place.  If  local  law 
enforcement  supports  a  federal  investigation,  it  will  integrate  into  the  federal 
investigative  management  model.  In  those  investigations  where  local  law  enforcement 
agencies  are  the  lead  for  the  investigation,  the  FBI  can  contribute  an  array  of  resources  to 
support  the  investigation  without  taking  over  command  of  the  investigation.  In  those 
cases,  it  is  incumbent  upon  local  law  enforcement  to  have  an  investigative  management 
model  ready  to  integrate  the  participation  of  multiple  agencies,  levels  of  government,  and 
disciplines  to  ensure  an  effective  and  efficient  investigation. 

2.  NIMS 

Part  of  the  national  support  structure  for  collaboration  is  the  National  Incident 

Management  System,  a  nationally  mandated  and  standardized  incident  management 

model  for  integrating  response  operations  from  various  levels  of  governments,  agencies, 

and  disciplines.  It  promotes  sound  management  principles,  including  unified  command, 
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which  fosters  consensus-building  in  the  decision-making  process.  The  PERF  report  on 
the  DC  Sniper  case  investigation,  the  NCR  Regional  Emergency  Coordination  Plan,  and 
the  COG  Police  Chiefs  Committee’s  Mutual  Aid  Operations  Plan  designate  NIMS  as  the 
model  for  managing  multiple  law  enforcement  agencies  in  an  investigative  or  operational 
response. 

All  of  the  local  law  enforcement  Delphi  panel  members  have  some  familiarity 
with  ICS,  but  most  of  them  do  not  have  a  sufficient  knowledge  to  construct  a  detailed 
plan  for  a  multijurisdictional  investigation.  The  author  is  a  state-certified  ICS  instructor 
and  has  taught  ICS-300/400  to  hundreds  of  trainees.  He  is  familiar  with  the  difficulty  that 
many  trainees  have  with  learning  this  system  and  retaining  its  principles.  With  its 
structures  and  substructures,  ICS  provides  a  high  level  of  functionality  as  a  planning  and 
management  tool;  however,  ICS  requires  lot  of  training  and  practical  use  before  it  can  be 
fully  understood  and  used  to  its  functional  capacity. 

Many  Delphi  panelist  described  ICS  as  a  use-it-or-lose-it  system,  meaning  that  in 
order  to  retain  knowledge  of  the  ICS  management  precepts,  ICS  must  be  used  in  a  real- 
world  environment  on  a  regular  basis.  Personnel  who  perform  functions  on  a  lower 
operational  level  normally  do  not  need  to  have  extensive  ICS  training  to  perform  those 
functions  within  a  large-scale  operation;  however,  those  at  the  higher  levels  and  the 
planners  need  to  have  a  good  working  knowledge  of  ICS  to  utilize  its  power  as  a 
management  tool.  For  staff  not  involved  in  the  planning  and  management  of  an  operation, 
NIMS  can  seem  confusing  or  superfluous;  therefore,  the  UK’s  Gold-Silver-Bronze 
system  may  be  more  intelligible  and  useful  in  providing  a  basic  understanding  of  how 
roles  are  divided  and  structured  within  a  large  response  operation.  The  Gold-Silver- 
Bronze  model  does  not  provide  as  much  functionality  as  an  organizational  tool  as  ICS, 
but  it  is  much  simpler  to  understand  since  it  only  distinguishes  three  basic  management 
structures:  Gold-Silver-Bronze. 

Although  the  NCR  Homeland  Security  Strategic  Plan  2010  (MWCOG,  2010a; 

MWCOG,  2010b)  and  the  Greater  Metropolitan  Area  Police  Mutual  Aid  Operations 

Plan  (MWCOG  Police  Chiefs  Committee,  2012)  reference  a  commitment  to  using 

NIMS,  and  specifically  ICS  and  the  public  information  function,  neither  of  these 
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documents  mentions  MAC  Groups — the  third  element  of  the  NIMS  component 
Command  and  Management.  The  PERF  report  (Murphy  &  Wexler,  2004)  recommends 
the  establishment  of  a  body  of  senior  officials  that  is  consistent  with  the  MAC  Group 
concept,  and  the  equivalent  of  a  MAC  Group  naturally  formed  during  the  DC  Sniper 
investigations.  However,  there  does  not  appear  to  be  a  practical  recognition  among  the 
Delphi  panelists  that  this  MAC  Group  oversight  and  support  structure  exists  within  the 
NIMS  model.  As  senior  representatives  from  the  participating  agencies,  a  MAC  Group 
can  support  unified  command  by  performing  a  function  similar  to  what  a  memorandum 
of  understanding  (MOU)  does  (e.g.,  committing  resources  and  funds,  coordinating 
decision-making  and  policies,  establishing  priorities,  and  providing  guidance  and 
direction).  While  the  Delphi  panelists  presented  no  familiarity  with  the  MAC  Group 
terminology  within  NIMS,  they  recognized  the  need  for  strategic  oversight  of  a  large- 
scale  investigation — the  purpose  of  a  MAC  Group.  The  Gold-Silver-Bronze  incident 
management  model  of  the  United  Kingdom  specifically  builds  a  structure  similar  to  MAC 
Groups  (Gold  level)  into  its  response  operations  plans. 

The  Delphi  panelists  agreed  that  when  unified  command  is  established  for  a 
regional  investigation,  the  appropriate  personnel  to  staff  those  positions  are  the  section 
commanders  of  the  investigative  units  involved  in  the  case  (e.g.,  homicide  section 
commanders,  crimes-against-persons  commanders).  When  a  MAC  Group  or  Gold  level  is 
established,  the  appropriate  personnel  to  staff  those  positions  are  the  chiefs-of-detectives 
from  the  respective  agencies.  Finally,  local  law  enforcement  investigative  managers  and 
supervisors  could  benefit  from  additional  training  in  ICS,  public  information,  and  MAC 
Group  concepts,  with  a  specific  focus  on  using  these  elements  in  managing  regional 
investigations. 


3.  Case  Management  System 

The  PERF  report  recommends  that  an  electronic  and  web-based  case  management 
system  be  used  to  manage  the  information  in  a  regional  investigation  and  that 
investigators  be  proficient  in  using  it.  The  FBI  supports  such  technology  in  a  system 
called  ORION,  and  local  law  enforcement  agencies  have  access  to  ORION  and  its 
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training  module  on  the  FBI’s  Law  Enforcement  Online  (LEO)  secure  website.  The  LEO 
version  of  ORION  has  the  same  functionality  as  the  ORION  system  used  on  the  FBI 
servers,  to  which  local  law  enforcement  does  not  have  access.  ORION  is  virtually 
unknown  to  the  NCR  local  law  enforcement  community;  however,  it  is  being  used  in  a 
limited  manner  by  one  NCR  homicide  squad.  In  addition,  ORION  appears  to  be  a  no-cost 
solution  to  the  problem  of  maintaining  a  web-based  case  management  system  that  can 
support  a  regional  local  law  enforcement  investigation  in  either  the  JOC  or  network  of 
command  posts  management  model.  Training  will  be  a  challenge  for  developing  and 
maintaining  competency  in  this  technology. 

4.  Joint  Operations  Center  versus  a  Network  of  Command  Posts 

According  to  the  Delphi  panelists,  the  local  law  enforcement  command  post  (CP) 
model  may  be  either  a  joint  operations  center  (JOC)  or  a  network  of  command  posts, 
depending  on  the  type  of  crimes  and  the  scope  of  the  investigation.  Although  the  tenn 
JOC  refers  to  a  specific  type  of  federal  facility,  the  tenn  will  be  used  here  to  refer  to  a 
generic  joint  command  post.  The  Delphi  panel  recognized  that  there  is  an  inherent 
difference  in  regional  pattern  crimes  depending  on  the  type  of  crime  and  the  impact  on 
the  community  and  that  different  management  models  would  be  appropriate  in  different 
circumstances.  The  JOC  model  would  be  more  appropriate  for  series  of  dynamic  crimes 
that  have  a  high  impact  on  the  public  (e.g.,  the  DC  Sniper  case),  where  the  need  for  a 
JOC  to  help  coordinate  the  investigative  response  would  be  more  pressing  and  where 
there  would  likely  be  the  political  will  to  establish,  equip,  staff,  and  fund  a  JOC.  The 
PERF  report  (Murphy  &  Wexler,  2004)  recommends  a  JOC  for  investigations  similar  to 
the  DC  Sniper  case,  as  do  the  Joint  Investigations  Teams  of  the  European  Union,  which 
use  a  JOC  structure  for  multinational  criminal  investigations.  The  Delphi  panelists  had  a 
strong  preference  for  working  within  a  JOC  structure,  rather  than  a  network  of  command 
posts  because  they  believe  that  communication,  relationship-building,  trust,  and 
information- sharing  would  be  superior  in  a  JOC  setting. 

While  local  law  enforcement  agencies  do  not  have  experience  in  setting  up, 
managing,  and  sustaining  a  JOC,  the  NCR  Type  3  incident  management  team  (IMT)  does 
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have  the  training,  experience,  and  equipment  necessary  to  perform  this  function.  While 
most  of  the  IMT  members  are  not  law  enforcement  personnel,  the  team  has  the 
management  skills  for  planning,  logistics,  financial  tracking,  etc.,  to  manage  a  large-scale 
operation.  The  IMT  could  manage  the  non-law  enforcement  duties  of  the  JOC  and  could 
serve  as  SMEs  for  law  enforcement  personnel  not  familiar  with  NIMS  and  the  operations 
of  a  large  command  post.  Furthennore,  SMEs  from  local  law  enforcement  could  then 
concentrate  on  the  investigation  of  the  case  without  the  distractions  of  the  ancillary  duties 
associated  with  the  overall  management  of  a  JOC.  The  cost  of  deploying  the  NCR  IMT 
would  be  the  responsibility  of  the  agencies  requesting  its  service;  however,  since  most  of 
the  IMT’s  members  already  serve  in  the  local  governments,  this  cost  may  be  mitigated 
considerably. 

Alternatively,  local  law  enforcement  could  make  a  formal  request  to  the  FBI  to 
support  a  local  investigation  by  standing  up  a  JOC.  The  FBI  would  evaluate  the  merits  of 
this  request  on  a  case-by-case  basis  in  making  its  determination  to  support  the 
investigation  in  this  manner. 

If  the  NCR  decided  that  the  NCR  IMT  or  the  FBI  would  not  establish  or  manage  a 
JOC,  local  law  enforcement  would  require  a  plan  for  establishing,  equipping,  staffing, 
managing,  and  funding  a  JOC. 

In  less  dynamic  pattern  crimes  with  a  lower  impact  on  the  public,  a  network  of 
command  posts  would  be  a  more  practical  model  because  there  would  probably  not  be 
the  political  will  to  staff  and  fund  a  JOC  for  those  types  of  investigations.  In  order  for  an 
investigative  network  to  function  well,  the  Delphi  panel  acknowledged  the  need  for  a 
management  support  system  that  addresses  the  command,  coordination,  communication, 
and  infonnation-sharing  needs  of  the  investigation.  In  a  network,  ICS  and  technology 
such  as  conference  calls,  video  teleconferencing,  and  a  web-based  case  management 
system  such  as  ORION  could  support  the  needs  of  the  investigation. 

Most  of  the  Delphi  panel  members  thought  that  a  joint  investigation  could  be 
managed  from  a  network,  but  some  SMEs  were  skeptical  about  the  potential  of 
technology  to  maintain  connectivity  between  investigating  agencies.  The  members  of  the 
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Delphi  panel  recognized  that  there  would  be  more  communication  and  coordination 
problems  in  a  network  than  in  a  JOC  where  personnel  are  collocated. 

Leaders  need  to  recognize  the  importance  of  working  together  as  a  team  in  a  joint 
investigation,  especially  a  networked  investigation.  In  addition,  they  need  to  recognize 
that  they  will  have  to  work  harder  at  doing  those  things  that  promote  collaboration  and 
prevent  those  things  that  hinder  collaboration.  Successful  collaboration  requires  effort. 
Furthennore,  successful  networked  collaboration  requires  more  effort. 

D.  TRAINING,  EXERCISES,  AND  EDUCATION 

Training  will  be  necessary  while  designing,  implementing,  and  sustaining  an  NCR 
framework  for  regional  investigations.  Because  of  the  novelty  of  this  investigative  model, 
there  will  be  new  training  requirements  at  all  levels  of  service  within  the  model.  Joint 
interagency  and  multidisciplinary  training  opportunities  will  help  to  break  down  barriers 
between  agencies,  improve  understanding  and  relationship-building  between  the 
agencies,  and  provide  another  signal  that  the  region  is  committed  to  building  its 
collaborative  capacity.  Exercises  that  follow  the  guidelines  of  the  Homeland  Security 
Exercise  and  Evaluation  Program  (HSEEP)  can  help  to  test  and  validate  preparedness  by 
identifying  gaps  in  plans,  policies,  procedures,  training,  technology,  and  equipment. 
Exercises  are  an  important  part  of  the  preparedness  cycle;  consequently,  agencies  should 
treat  them  as  vital  to  upgrading  the  NCR  levels  of  investigative  preparedness.  HSEEP 
provides  a  professional  and  standard  model  for  designing,  conducting,  and  evaluating 
exercises.  Through  the  NCR’s  Exercise  and  Training  Operations  Panel,  there  is  a  great 
deal  of  support  for  planning,  conducting,  and  evaluating  exercises  proposed  by  the  NCR 
regional  emergency  support  functions  such  as  the  Police  Chiefs  Committee. 

Joint  educational  programs  like  the  joint  professional  military  education  (JPME) 
and  the  Naval  Postgraduate  School’s  Center  for  Defense  and  Homeland  Security  master’s 
program  can  enhance  the  critical  thinking  and  problem-solving  skills  necessary  to  tackle 
homeland  security  issues  in  an  a  complex  and  networked  environment.  These  programs 
help  to  build  the  collaborative  capacity  of  homeland  security  professionals  by  exposing 
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them  to  other  disciplines  and  a  range  of  ideas  that  form  the  tapestry  of  the  homeland 
security  project. 


E.  INTEGRATING  OTHER  DISCIPLINES 

The  PERF  report,  NIMS,  and  the  Delphi  panelists  all  recognize  the  importance  of 
integrating  the  public  infonnation  function  into  an  investigative  framework  through 
preplanning  and  training.  NIMS  has  a  model  for  assimilating  the  unified  PIO  function 
into  incident  management  via  the  Joint  Infonnation  System  (JIS)  /  Joint  Information 
Center  (JIC).  The  NCR  Emergency  Support  Function  15  (External  Affairs  Committee)  is 
a  very  active  R-ESF  and  has  adopted  the  use  of  the  JIC  model  in  its  planning  and 
operations;  therefore,  it  would  be  relatively  easy  to  incorporate  this  function  into  an  NCR 
regional  investigative  framework. 

Along  with  the  PIO  function,  there  is  a  role  for  the  fire  department  and  fusion 
center  disciplines  in  some  regional  investigations.  Fire  department  and  law  enforcement 
personnel  often  cross  paths  when  responding  to  crimes  that  are  part  of  a  regional  pattern. 
A  broader  and  more  valuable  use  of  the  fire  department  discipline  can  occur  if  law 
enforcement  considers  training  opportunities  that  would  help  fire/EMS  personnel 
understand  the  needs  of  law  enforcement  at  crime  scenes,  or  how  fire/EMS  can  provide 
investigative  intelligence  by  serving  as  extra  eyes  and  ears  in  the  community. 
Furthennore,  many  fire/EMS  chief  officers  are  ICS  SMEs  and  can  assist  law  enforcement 
in  establishing  an  incident  management  structure  and  managing  a  large-scale 
investigation.  Additionally,  some  investigative  management  responsibilities  do  not 
require  law  enforcement  expertise,  but  rather  expertise  on  how  to  manage  tasks  and 
resources — a  skill  possessed  by  ICS  SMEs. 

Depending  on  the  seriousness  and  scope  of  a  regional  investigation,  the  fusion 
centers  can  contribute  to  the  investigation.  They  can  conduct  computer  background 
checks  on  large  numbers  of  suspects,  provide  the  architecture  for  managing  a  large 
amount  of  infonnation,  support  the  intelligence  needs  of  the  investigation  in  other  ways, 
and  disseminate  FOUO-LES  products  to  a  wide  LE  audience. 
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F.  CHALLENGES 

The  Delphi  panel  was  very  much  in  agreement  about  many  of  the  main  elements 
that  should  be  in  an  NCR  investigative  framework;  therefore,  much  of  the  plan  can  be 
developed  without  having  to  negotiate  differences  between  jurisdictions.  Although  a 
substantial  collaborative  capacity  already  exists  in  the  NCR,  there  will  be  some 
challenges  relating  to  engendering  and  sustaining  collaboration  among  new  partners 
while  constructing  the  regional  investigative  model.  A  primary  challenge  will  be 
acquiring  the  funding  to  support  secure  conference  call  and  video  teleconferencing 
technology  for  investigative  units  throughout  the  NCR.  This  technology  will  have  to 
compete  with  other  NCR  grant  priorities. 

Another  challenge  will  be  carving  out  the  necessary  time  from  the  already  full 
schedules  of  managers,  supervisors,  and  investigators  to  work  in  various  workgroups  to 
generate  a  framework  for  regional  investigations.  Technology,  training,  and  incident 
management  workgroups  will  be  necessary  to  bring  this  project  to  fruition. 

Many  of  the  components  necessary  for  creating  this  investigative  model  already 
exist.  The  underlying  rationale  for  creating  a  collaborative  investigative  plan  are 
enumerated  clearly  in  documents  or  research  from  the  federal  government,  the  NCR,  and 
academia.  The  PERF  report  on  the  DC  Sniper  case  provides  many  reasonable 
recommendations  based  upon  lessons-leamed  from  that  investigation.  NIMS  provides  a 
good  incident  management  model  for  conducting  regional  operations,  whether  they  are 
law  enforcement  related  or  not.  In  addition,  the  UK  incident  management  model 
contributes  additional  insight  into  how  to  organize  and  manage  a  multiagency 
investigation.  The  procedures  for  setting  up  and  staffing  a  JOC  already  exist — both  at 
the  federal  level  using  a  non-ICS  model,  and  at  the  local  level  by  the  NCR  IMT  using  the 
ICS  model. 

The  Delphi  panel  demonstrated  that  the  NCR  recognizes  the  need  to  create  a 
regional  investigative  framework  and  is  in  agreement  about  most  of  the  major 
components  that  should  be  in  the  plan.  The  law  enforcement  Delphi  panel  members  were 
unanimous  in  their  agreement  that  there  is  no  need  to  have  common  investigative 
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protocols  throughout  the  NCR;  however,  there  is  a  need  to  have  agreement  on  how 
multiple  law  enforcement  agencies  will  work  together,  communicate,  coordinate,  and 
share  information. 

The  NCR  has  a  great  collaborative  capacity.  There  are  federal  and  regional 
documents  that  encourage  collaboration,  while  the  Metropolitan  Washington  Council  of 
Governments  sustains  collaborative  efforts  in  a  variety  of  ways  (e.g.,  support  of  regional 
emergency  support  functions,  a  homeland  security  strategic  plan,  grant  investments).  The 
PERF  report  on  the  DC  Sniper  case  and  the  National  Incident  Management  System 
provide  specific  guidance  on  how  to  manage  a  regional  investigation.  The  Delphi  panel 
demonstrated  solid  agreement  with  this  guidance,  and  even  provided  a  nuanced 
contingency  in  deploying  a  JOC  by  leaving  open  the  possibility  of  managing  some 
regional  investigations  using  a  network  of  command  posts  instead  of  a  JOC.  Moreover, 
the  panel  was  in  agreement  with  academic  research  and  the  PERF  report  about  those 
factors  that  tend  to  promote  or  hinder  collaboration.  In  addition,  the  panel  was  also  in 
agreement  about  the  value  of  leveraging  the  assets  of  other  disciplines  (e.g.,  fire/EMS, 
fusion  centers,  and  public  information,  into  a  law  enforcement  investigation,  training,  and 
exercises).  Finally,  the  panel  identified  certain  challenges  such  as  the  availability  and 
dependency  on  technology,  technology  training,  and  human  factors  that  tend  to  inhibit 
collaboration. 

Based  upon  the  conclusions  enumerated  in  this  chapter,  the  next  chapter  proposes 
recommendations  to  the  Metropolitan  Washington  Council  of  Governments’  Police 
Chiefs  Committee  concerning  how  it  can  achieve  the  goal  of  generating  an  integrated 
intergovernmental,  interagency,  and  multidiscipline  framework  for  the  investigation  of 
pattern  crimes  spanning  multiple  NCR  jurisdictions. 
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VIII.  RECOMMENDATIONS 


The  recommendations  in  this  chapter  are  directed  towards  the  NCR’s  Police 
Chiefs  Committee  (Committee),  the  lead  for  the  regional  emergency  support  function  13 
(R-ESF  13),  public  safety  and  security.  As  the  R-ESF  13  lead,  the  committee  sets  the 
collaborative  goals  for  the  region,  supports  regional  programs,  and  recommends 
investment  priorities  for  grants.  It  is  only  through  the  support  of  this  committee  that  the 
recommendations  proposed  in  this  paper  can  come  to  fruition. 

Recognizing  that  there  is  no  NCR  local  law  enforcement  investigative  framework 
in  place  to  conduct  regional  investigations  similar  to  the  DC  Sniper  case,  or  even  pattern 
crimes  of  lesser  gravity  spanning  multiple  jurisdictions,  the  committee  should  consider 
taking  proactive  actions  to  support  shaping  a  framework  for  regional  investigative 
solutions. 

A.  RECOMMENDATION  1 

To  signal  its  recognition  of  criminal  investigations  as  an  essential  component  of 
the  overall  law  enforcement  mission,  the  committee  should  consider  incorporating  an 
Investigations  Subcommittee  to  oversee  the  crafting  of  the  guidelines  for  regional 
investigations  and  to  address  other  pressing  issues  relating  to  investigations.  This  would 
signal  the  committee’s  strong  support  of  this  project  that  would  garner  the  other  support 
necessary  to  develop  the  model.  The  oversight  of  the  Investigations  Subcommittee  could 
be  managed  by  a  small  cadre  of  senior  investigative  officers  (e.g.,  chiefs  of  detectives) 
representative  of  the  three  main  regions  of  the  NCR  (Maryland,  D.C.,  and  Northern 
Virginia),  as  well  as  federal  law  enforcement  (e.g.,  Assistant  Special  Agent  in  Charge) 
for  the  FBI,  and  possibly  even  the  ATF.  This  would  have  the  added  benefit  of 
establishing  intergovernmental  and  interagency  relationships  between  high-level 
investigative  managers. 
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B.  RECOMMENDATION  2 

The  committee  should  identify  a  project  manager  to  work  within  the 
Investigations  Subcommittee  to  shepherd  this  project  to  fruition.  The  project  manager 
should  oversee  the  development  of  all  aspects  of  the  model  and  should  report  to  the 
subcommittee’s  oversight  panel. 

C.  RECOMMENDATION  3 

The  Investigations  Subcommittee  should  be  tasked  with  working  out  the  details  of 
creating  a  flexible  and  scalable  model  for  managing  a  regional  investigation. 
Membership  in  the  subcommittee  should  consist  of  inter-jurisdictional  investigative 
managers  (e.g.,  major  crimes  section  commanders),  supervisors,  and  detectives,  all  of 
whom  would  have  a  stake  in  the  model  since  they  would  be  the  ones  working  within  its 
framework.  In  addition,  the  subcommittee  work  teams  should  be  responsible  for 
cultivating  the  capabilities  necessary  to  make  a  workable  investigative  model  (e.g., 
communication,  data-sharing,  incident  management,  and  planning).  These  work  teams 
would  also  help  to  foster  the  inter-jurisdictional  relationships  that  are  deemed  necessary 
for  collaboration  in  a  real-world  response. 

D.  RECOMMENDATION  4 

The  Investigations  Subcommittee  should  strongly  consider  the  recommendations 
gleaned  from  the  NCR  Delphi  panel  of  SMEs  and  the  Police  Executive  Research  Forum’s 
(PERF)  report  on  the  DC  Sniper  case.  The  PERF  report  (Murphy  &  Wexler,  2004)  made 
many  recommendations  based  upon  input  from  key  personnel  involved  in  that 
investigation. 

The  investigative  SMEs  on  the  Delphi  panel  carefully  examined  many  of  the 
issues  relating  to  regional  investigations,  and  were  in  very  close  agreement  on  many 
weightier  issues,  e.g.,  incident  command;  a  JOC  versus  a  network  of  command  posts; 
training  and  exercises;  collaborative  partnerships;  and  the  incorporation  of  other 
disciplines  into  the  investigations.  Their  input  and  recommendations  mirror 
recommendations  made  by  the  PERF  report,  as  well  as  national  and  regional 
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preparedness  documents.  Their  insights  lay  a  solid  foundation  for  building  the 
framework. 

E.  RECOMMENDATION  5 

The  Investigations  Subcommittee  should  build  the  regional  model  for  incident 
management  using  the  principles  of  the  National  Incident  Management  System  (NIMS). 
NIMS  is  the  national  model  for  incident  management  and  has  already  been  accepted  as 
the  model  for  joint  law  enforcement  responses  in  the  NCR.  The  command  and 
management  component  of  NIMS  has  three  elements  that  can  serve  as  the  bases  for 
building  the  NCR  model:  the  incident  command  system,  multiagency  coordination 
groups,  and  public  information.  These  elements  would  be  very  useful  to  the  planners  for 
establishing  the  model,  but  the  planners  should  also  consider  adopting  the  UK’s  Gold- 
Silver-Bronze  verbiage  to  help  those  who  do  not  need  to  know  the  in-depth  details  of  the 
plan  to  understand  the  overall  concepts  of  the  plan.  Two  possible  organizational 
structures  for  incident  management  are  shown  in  Appendix  B. 

F.  RECOMMENDATION  6 

The  Investigations  Subcommittee  should  consider  the  merits  of  using  a  JOC  or  a 
network  of  command  posts  (network)  to  manage  regional  investigations.  The  two  models 
are  appropriate  for  different  circumstances,  yet  the  regional  investigative  model  should 
address  how  each  command  post  style  will  be  used  if  deployed  in  an  investigation. 
Creating  JOC  protocols  will  require  a  significant  level  of  planning  to  identify  logistical, 
planning,  and  management  requirements.  There  are  several  possible  options  for  managing 
a  joint-command -post  that  should  be  considered  (e.g.,  the  JOC  could  be  managed  by  the 
NCR  Incident  Management  Team,  the  FBI,  local  law  enforcement  agencies,  or  a 
combination  of  any  of  these). 

G.  RECOMMENDATION  7 

The  Investigations  Subcommittee  should  examine  the  technology  requirements  to 
facilitate  communication,  coordination,  and  data-sharing  for  an  investigation  being 
managed  from  a  JOC  or  a  network  of  command  posts.  The  Delphi  panel  and  PERF  report 
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identified  secure  audio  and  video  communication  and  an  electronic  networked  case  file  as 
necessary  for  maintaining  communication  and  investigative  data.  The  Delphi  panel  and 
PERF  report  also  recommend  that  data-sharing  technology  be  used  to  maintain  a  common 
case  file.  This  technology  seems  to  already  exist  if  the  fonn  of  the  FBI’s  ORION  case 
management  system  available  online  at  no-cost.  The  subcommittee  should  enlist  the 
assistance  of  the  MWCOG’s  regional  emergency  support  function  2  chief  information 
officers  to  assist  with  identifying  technology  requirements  and  solutions. 

H.  RECOMMENDATION  8 

The  Investigations  Subcommittee  should  address  how  to  leverage  the  full 
capabilities  of  non-law  enforcement  disciplines  in  the  NCR  to  support  a  regional 
investigation.  The  body  of  this  paper  discusses  ways  in  which  the  fire/EMS,  fusion 
centers,  and  public  information  disciplines  can  support  regional  investigations.  R-ESF 
#15  (public  infonnation),  R-ESF  4  (fire/EMS),  and  the  three  fusion  centers  serving  the 
NCR  should  be  made  part  of  the  planning  process  so  they  can  develop  a  stake  in  the  plan 
and  clarify  how  their  subject  matter  expertise,  technology,  and  personnel  could  be 
maximized  to  support  an  investigation.  There  are  other  disciplines  such  as  the  R-ESF  1 
(transportation),  R-ESF  2  (chief  infonnation  officers),  and  R-ESF  5  (emergency 
managers)  that  may  also  be  able  to  provide  helpful  insights  on  how  they  could  support 
investigations. 

I.  RECOMMENDATION  9 

The  Investigations  Subcommittee  should  produce  an  education,  training,  and 
exercise  program  to  help  build,  maintain,  and  sustain  the  capabilities  necessary  to 
conduct  regional  investigations.  The  subcommittee  can  leverage  the  assistance  of  NCR 
resources,  such  as  the  Exercise  and  Training  Operations  panel  (ETOP),  to  develop  a 
multi-year  training  and  exercise  plan  for  this  project.  Training  for  fundamental 
components  of  the  framework  (e.g.,  technology,  NIMS,  federal  resources  available  to 
support  local  law  enforcement,  command  posts)  will  be  necessary  for  most  managers, 
supervisors,  and  investigators  working  within  the  model. 
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The  Police  Chiefs  Committee  should  consider  sponsoring  mid  to  senior  level 
managers  to  participate  in  formal  education  program  such  as  the  master’s  program  or  the 
Executive  Leaders  Program  offered  by  the  Naval  Postgraduate  School’s  Center  for 
Homeland  Defense  and  Security.  These  programs  emphasize  the  enhancement  of  the 
critical  thinking,  problem-solving,  and  collaborative  skills  necessary  to  boost  the 
multidisciplinary  collaborative  capacity  of  the  NCR  to  tackle  a  variety  of  homeland 
security  issues. 

J.  RECOMMENDATION  10 

The  Police  Chiefs  Committee  should  consider  this  project  as  a  funding  priority  in 
its  recommendations  for  grant  investments.  Technology  to  support  secure  audio  and 
video  teleconferencing  for  investigative  units  will  require  some  investments.  If  the 
subcommittee  recommends  that  local  law  enforcement  should  develop  the  capability  to 
stand  up,  equip,  staff,  and  manage  a  JOC,  an  investment  would  be  needed  to  build  and 
maintain  that  capability. 

These  recommendations  provide  for  a  degree  of  innovation  and  differentiation 
that  has  not  been  seen  in  regional  local  law  enforcement  investigations  in  the  NCR.  The 
creation  of  a  virtual  command  post  by  leveraging  technology  to  link  multiple  command 
posts  in  different  jurisdictions  is  a  way  for  the  NCR  to  effectively  manage  some  regional 
investigations  without  the  need  for  standing  up  an  expensive  JOC.  Interoperable 
communication  and  data-sharing  technology  can  now  facilitate  information-sharing, 
communication,  and  coordination  in  a  way  that  was  not  possible  in  the  recent  past.  The 
incorporation  of  the  MAC  Group  into  the  ICS  management  model  promotes  a  degree  of 
senior-level  managerial  oversight  that  sometimes  naturally  occurs  in  an  investigation,  but 
it  should  be  planned  for. 

Over  decades,  the  National  Capital  Region  has  built  a  collaborative  capacity 
across  a  wide  range  of  homeland  security  disciplines.  These  recommendations  can 
facilitate  the  expansion  of  that  capacity  so  the  National  Capital  Region  is  prepared  to 
effectively  and  efficiently  manage  an  integrated  intergovernmental,  interagency,  and 
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multidisciplinary  investigative  response  to  a  critical  series  of  crimes  spanning  multiple 
jurisdictions. 
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APPENDIX.  DELPHI  PANEL  QUESTIONNAIRE 


Background 

1 .  What  is  your  name? 

2.  Do  you  understand  that  this  interview  is  being  audio  recorded?  Do  you  consent  to 
this  recording? 

3.  What  agency  do  you  work  for? 

4.  What  is  your  phone  number? 

5.  What  is  your  email  address? 

6.  What  is  the  discipline  that  you  represent? 

Law  enforcement 
Fire/EMS 
Public  infonnation 
Fusion  centers 

7.  What  is  your  position  within  your  agency? 

8.  What  is  your  title  or  rank  within  your  agency? 

9.  How  long  have  you  served  in  this  discipline? 

10.  Do  you  currently  serve,  or  have  you  recently  served,  on  any  boards,  regional  work 
groups,  emergency  support  functions,  emergency  operations  centers,  or  other 
collaborative  entities  within  the  National  Capital  Region  (NCR)  or  within  your  own 
jurisdiction?  If  yes,  please  elaborate. 

Collaborative  Experience 

1 1 .  Have  you  been  involved  in  any  capacity  with  a  law  enforcement  investigation  which 
spanned  multiple  jurisdictions?  If  yes, 

Please  identify  and  explain  three  elements  that  you  believe  fostered  good 
collaboration. 

Please  identify  and  explain  three  elements  that  you  believe  hindered  good 
collaboration. 

12.  Have  you  have  been  involved  in  any  capacity  with  any  other  type  of  planning, 
project,  or  incident  that  required  regional  or  multi-discipline  collaboration?  If  yes, 

Please  identify  and  explain  three  elements  that  you  believe  fostered  good 
collaboration. 

Please  identify  and  explain  three  elements  that  you  believe  hindered  good 
collaboration. 
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13.  Please  explain  how  you  view  the  role  of  leadership  in  cultivating  and/or  hampering 
collaboration. 

14.  Please  explain  what  you  see  as  necessary  elements  to  promote  personal  trust  in  a 
collaborative  environment. 

15.  Please  explain  what  you  see  as  barriers  to  fostering  personal  trust  in  a  collaborative 
environment. 

16.  Are  you  familiar  with  the  NCR’s  Regional  Emergency  Coordination  Plan  (RECP)? 

17.  Are  you  familiar  with  the  NCR’s  Regional  Incident  Communications  and 
Coordination  System  (RICCS)? 

Incident  Management  Principles 

18.  Please  identify  and  explain  your  experiences  with  any  investigations,  incidents,  or 
events  in  which  the  National  Incident  Management  System’s  Incident  Command 
System  (ICS)  was  used  to  manage  the  process. 

19.  From  your  knowledge  and  experience,  please  identify  what  you  consider  the 
strengths  of  ICS? 

20.  From  your  knowledge  and  experience,  please  identify  what  you  consider  the 
weaknesses  of  ICS? 

21.  If  you  are  familiar  with  the  United  Kingdom’s  incident  management  model  known  as 
the  “Gold,  Silver,  and  Bronze,”  please  provide  any  recommendations  about  how  that 
model  can  be  adapted  for  use  in  managing  incidents  in  the  NCR? 

22.  For  regional  investigations,  would  you  prefer  a  centralized  command  post  to  manage 
the  investigation,  or  a  series  of  networked  decentralized  command  posts  within  the 
individual  jurisdictions? 

23.  Are  you  aware  of  an  investigative  case  management  system  that  is,  or  can  be 
networked  within  the  NCR? 

Managing  a  Multijurisdictional  Investigation  Involving  a  Series  of 

Related  Sexual  Assaults  &  Murders  in  the  NCR. 

24.  This  question  is  for  Law  Enforcement  Discipline  Only:  If  this  series  of  crimes  were 
to  occur  in  the  NCR,  are  there  any  regional  investigative  protocols  for  fostering  a 
collaborative  law  enforcement  investigation  spanning  multiple  NCR  jurisdictions? 
For  example,  are  there  regional  protocols  for: 


Command  of  the  multijurisdictional 
investigation 

Determining  level  of  each  agency’s 
participation  in  the  investigation 

Roles  and  responsibilities  for  each 
agency 


Prioritizing  needs  of  individual 
agencies  vs.  the  task  force  of 
agencies  involved  in  the 
investigation 

Briefings — frequency,  content, 
situational  awareness,  responsibility 
for  conducting 
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Establishing,  staffing,  and  managing 
a  joint  operations  center 

Crime  scene  management 

Evidence  collection,  storage,  and 
processing 

Managing  investigative  leads 

Interviews  &  interrogations 

Charging  suspects 

Surveillance  operations 

Intelligence  collection  &  sharing 

Communication  between 
investigators 

Security  of  investigative 
communications 

Coordination  of  tip  lines 

Media  plan:  Release  of  public 
information/speaking  with  one  voice 

Obtaining  legal  advice 


Resource  management 
Case  management 
Autopsy  protocols 

Using  uninfonned  patrol  officers  to 
enhance  the  investigation  and  calm 
public  fears 

Using  traffic  management  principles 
and  roadblocks  for  containment  or 
movement 

Sustainable  alternate  shift  plans  for 
investigators  and  uniformed  officers 

Tactical  teams 

Arrest  teams 

Ensuring  adequate  technology 
capabilities  to  support  the 
investigation 

Prosecution  task  force 

Victim  assistance  task  force 
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25.  If  these  regional  protocols  do  not  exist,  how  would  you  recommend  that  they  be 
developed  for  the  NCR? 

26.  How  would  you  foster  communication  and  coordination  within  your  own  discipline? 

27.  How  would  you  foster  communication  and  coordination  between  disciplines? 

28.  What  can  be  done  within  your  own  discipline  (e.g.,  law  enforcement,  fire/EMS, 
public  infonnation,  fusion  centers)  to  promote  a  collaborative  process  and  improve 
the  outcome  of  a  multijurisdictional  investigation? 

29.  What  can  be  done  by  the  other  disciplines  (e.g.,  law  enforcement,  fire/EMS,  public 
information,  fusion  centers)  to  promote  a  collaborative  process  and  improve  the 
outcome  of  a  multijurisdictional  investigation? 

30.  What  kinds  of  technology  do  you  think  could  benefit  a  collaborative  process  (e.g., 
command,  control,  coordination,  communications)  in  a  multijurisdictional 
investigation  within  the  NCR? 

3 1 .  Please  explain  any  other  challenges  that  you  see  in  working  within  your  discipline, 
and  between  disciplines,  in  managing  a  multijurisdictional  investigation  in  the 
National  Capital  Region. 
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Incident  Command  Organization  Chart  -  Joint  Command  Post 


ICS-207 


Note:  When  using  ICS,  only  activate  those  organizational  structures  that  are  necessary  for  the  investigation. 


Table  8.  Sample  ICS  Organization  for  a  Multijurisdictional  Investigation:  Joint  Command 

Post  Model 
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Sample  Incident  Command  Chart  For  a  Multi-jurisdictional  Investigation  -  Network  of  Command  Posts  Model 

(with  MAC  Group  /  Gold  Level) 
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Multiagency  Coordinating  Group  (MAC  Group) 

(Comprised  of  Senior  Investigative  Personnel, 
e.g.  Assistant  Chiefs  from  Jurisdictions  1, 2, 3, 4,  5) 
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This  organizational  chart  shows  the  general  structure  for  the  management  of  a  multi-junsdictional  investigation  with  an  emphasis  on  the  MAC  Group  (Gold  Level)  and  Incident  Command  I  Unified  Command  (Silver  Level). 

The  chart  includes  the  three  components  of  the  NIMS  element  'Command  and  Management:'  1 .)  Incident  Command  System  (ICS);  2.)  Joint  Information  System  (JIS);  and  3.)  Multiagency  Coordination  System  (MAC 
Group),  The  MAC  Group  (Gotd  level)  performs  an  oversight  and  coordinating  role  for  the  investigation  and  supports  Unified  Command.  Unified  Command  includes  Incident  Commanders  from  agencies  affected  by  the 
crimes  and  which  dedicate  a  major  level  of  resources  to  the  investigation.  The  Joint  Information  Center  (JIC)  is  part  of  the  JIS  and  is  oomprised  of  Public  Information  Officers  (PIOs)  from  the  involved  junsdlctions, 

In  addition  to  Unified  Command,  several  other  functions  should  be  organized  as  unified  disciplines,  e.g.  Public  Information,  Intelligence.  &  Prosecution.  The  organization  of  the  Operations  Section  will  vary  depending  on 
the  needs  of  the  investigation.  The  Planning,  Logistics,  and  Finance  Sections  can  be  added,  as  needed. 


Table  9.  Sample  ICS  Organization  for  a  Multijurisdictional  Investigation:  Network  of 

Command  Post  Model 
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